Software Development

Contributors Victor R. Basili is a Professor of Computer Science at the University of Maryland, College Park. He holds...

Author: Marvin Zelkowitz Ph.D. MS BS.

257 downloads 3686 Views 4MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!
Report copyright / DMCA form

DOWNLOAD PDF

Contributors

Victor R. Basili is a Professor of Computer Science at the University of Maryland, College Park. He holds a Ph.D. in Computer Science from the University of Texas, Austin and is a recipient of two honorary degrees from the University of Sannio, Italy (2004) and the University of Kaiserslautern, Germany (2005). He was Director of the Fraunhofer Center for Experimental Software Engineering - Maryland and a director of the Software Engineering Laboratory (SEL) at NASA/GSFC. He works on measuring, evaluating, and improving the software development process and product. Dr. Basili is a recipient of several awards including the NASA Group Achievement Awards, the ACM SIGSOFT Outstanding Research Award, the IEEE computer Society Harlan Mills Award, and the Fraunhofer Medal. He has authored over 250 journal and refereed conference papers, served as co-Editor-in-Chief of the Springer Journal of Empirical Software Engineering and is an IEEE and ACM Fellow. He can be reached at [email protected]. Hal Berghel is currently Associate Dean of the Howard R. Hughes College of Engineering, Founding Director of the School of Informatics, and Professor of Computer Science at the University of Las Vegas. He is also the founding Director of the Center for CyberSecurity Research and the Identity Theft and Financial Fraud Research and Operations Center. The author of over 200 publications, his research has been supported by business, industry, and government for over 25 years. He is both an ACM and IEEE Fellow and has been recognized by both organizations for distinguished service to the profession. His consultancy, Berghel.Net, provides technology consulting services to government and industry. Jose´ Carlos Cortizo Pe´rez (http://www.ainetsolutions.com/jccp) received his M.S. degree in Computer Science and Engineering from Universidad Europea de Madrid. His research areas include data preprocessing in machine learning and data-mining, composite learning methods, AI applications on astrophysics and noisy information retrieval. He is also co-founder of AINetSolutions (http://www.ainetsolutions.com), a data-mining startup.

ix

x

CONTRIBUTORS

James Cusick is an Assistant Director of Web Software Engineering in Wolters Kluwer’s Corporate Legal Services Division where he provides strategic direction for software development. Previously, James held a variety of roles with AT&T and Bell Labs. James is the author more that 3 dozen papers and talks on Software Reliability, Object Technology, and Software Engineering Technology. He has also held the position of Adjunct Assistant Professor at Columbia University’s Department of Computer Science where he taught Software Engineering. James is a graduate of both the University of California at Santa Barbara and Columbia University in New York City and a member of IEEE. James is also a certified PMP and can be reached at j. [email protected]. Jose´ Marıá Go´mez Hidalgo holds a Ph.D. in Mathematics, and has been a lecturer and researcher at the Universidad Complutense de Madrid (UCM) and the Universidad Europea de Madrid (UEM), for 10 years, where he has been the Head of the Department of Computer Science. Currently he is Research and Development Director at the security firm Optenet. His main research interests include Natural Language Processing (NLP) and Machine Learning (ML), with applications to Information Access in newspapers and biomedicine, and Adversarial Information Retrieval with applications to spam filtering and pornography detection on the Web. He has taken part in around 10 research projects, heading some of them. Jose´ Marıá has co-authored a number of research papers in the topics above, which can be accessed at his home page. He is Program Committee member for CEAS 2007, the spam Symposium 2007 and other conferences, and he has reviewed papers for JASIST, ECIR, and others. He has also reviewed research project proposals for the European Commission. Anna Hac´ received the M.S. and Ph.D. degrees in Computer Science from the Department of Electronics, Warsaw University of Technology, Poland, in 1977 and 1982, respectively. She is a Professor in the Department of Electrical Engineering, University of Hawaii at Manoa, Honolulu. She has been a Visiting Scientist at the Imperial College, University of London, England, a Postdoctoral Fellow at the University of California at Berkeley, an Assistant Professor of Electrical Engineering and Computer Science at The Johns Hopkins University, a Member of Technical Staff at AT&T Bell Laboratories, and an ONR/ASEE Senior Summer Faculty Fellow at the Naval Research Laboratory and SPAWAR. Her research contributions include system and workload modeling, performance analysis, reliability, modeling process synchronization mechanisms for distributed systems, distributed file systems, distributed algorithms, congestion control in high-speed networks, reliable software architecture for switching systems, multimedia systems, wireless networks, and network protocols. Her research interests include multimedia, wireless data and

CONTRIBUTORS

xi

sensor networks, and nanotechnology for information processing. She is a member of the Editorial Board of the IEEE Transactions on Multimedia, and is on the Editorial Advisory Board of Wiley’s International Journal of Network Management. Lorin Hochstein received a Ph.D. in computer science from the University of Maryland, an M.S. in electrical engineering from Boston University, and a B.Eng. in computer engineering from McGill University. He is currently an Assistant Professor in the Department of Computer Science and Engineering at the University of Nebraska at Lincoln. He is a member of the Laboratory for Empirically-based Software Quality Research and Development (ESQuaReD). His research interests include combining quantitative and qualitative methods in software engineering research, software measurement, software architecture, and software engineering for high-performance computing. He is a member of the IEEE Computer Society and ACM. David Hoelzer is well known in the information security industry as an expert in the fields of intrusion detection, incident handling, information security auditing, and forensics. David is the Director of Research for Enclave Forensics (www.enclaveforensics.com). He also serves as the CISO for Cyber-Defense (www.cyber-defense.org). David has been named a SANS Fellow, a Research Fellow with the Internet Forensics Center and an adjunct research associate of the UNLV Center for Cybersecurity Research. In these roles his responsibilities have included acting as an expert witness for the Federal Trade Commission, teaching at major national and international SANS conferences and handling security incident response and forensic investigations for several corporations and financial institutions. David has provided advanced training to security professionals from organizations including NSA, USDA Forest Service, most of the Fortune 500, DHHS, various DoD sites and many universities. Yasushi Ishigai is Research Director of Research Center for Information Technology at Mitsubishi Research Institute, INC, Tokyo, Japan. And he is also a part time researcher at Software Engineering Center of Information technology Promotion Agency, Japan. Yasushi Ishigai received a degree in mechanical engineering (B.Sc. and M.Sc.) from the University of Tokyo, Japan, in 1988. His research interest and industrial activities include quantitative management, especially software cost modeling. Nahomi Kikuchi received a B.S. degree in mathematics from Niigata University, Japan, a Master’s degree in computer science (MSCS) from Stanford University, and a degree of Doctor of Engineering from Osaka University, Japan. She is a manager

xii

CONTRIBUTORS

for software quality group at Oki Electric Industry Co., Ltd. Japan. Her earlier work at OKI includes the design and verification methods and support systems for telecommunication software systems using ITU-T’s SDL Language and Petri net. She has experience of leading a number of software projects. Her recent research and industrial activities include software quality assurance, quality management, and process improvement techniques with emphasis on quantitative methods and measurement and application of software engineering techniques, tools and methods. She has been a part-time researcher at Software Engineering Center, Information-technology Promotion Agency Japan since October 2004. She is a member of IEEE, the IEEE Computer Society, and IPSJ(Japan). Michael Kla¨s received his degree in computer science (Diploma) from the University of Kaiserslautern, Germany, in 2005. He is currently a researcher at the Fraunhofer Institute for Experimental Software Engineering (IESE), Kaiserslautern, Germany and member of DASMA, the German member organization of the International Software Benchmarking Standards Group (ISBSG). As a member of the Processes and Measurement department, he works on national and international research and industrial projects. His research and industrial activities include goaloriented measurement, balancing strategies for quality assurance, and software cost modeling. Ju¨rgen Mu¨nch is Division Manager for Software and Systems Quality Management at the Fraunhofer Institute for Experimental Software Engineering (IESE) in Kaiserslautern, Germany. Before that, Dr. Mu¨nch was Department Head for Processes and Measurement at Fraunhofer IESE and an executive board member of the temporary research institute SFB 501, which focused on software product lines. Dr. Mu¨nch received his Ph.D. degree (Dr. rer. nat.) in Computer Science from the University of Kaiserslautern, Germany, at the chair of Prof. Dr. Dieter Rombach. Dr. Mu¨nch’s research interests in software engineering include: (1) modeling and measurement of software processes and resulting products, (2) software quality assurance and control, (3) technology evaluation through experimental means and simulation, (4) software product lines, (5) technology transfer methods. Dr. Mu¨nch has significant project management experience and has headed various large research and industrial software engineering projects, including the definition of international quality and process standards. His main industrial consulting activities are in the areas of process management, goal-oriented measurement, quality management, and quantitative modeling. He has been teaching and training in both university and industry environments. Dr. Mu¨nch has co-authored more than 80 international publications, and has been co-organizer, program co-chair, or member of the program committee of numerous high-standard software engineering

CONTRIBUTORS

xiii

conferences and workshops. Ju¨rgen Mu¨nch is a member of ACM, IEEE, the IEEE Computer Society, and the German Computer Society (GI). Taiga Nakamura received the B.E. and M.E. degrees in aerospace engineering from University of Tokyo in 1997, 1999, respectively. He received the Ph.D. degree in computer science from University of Maryland, College Park in 2007. He is presently a Research Staff Member at IBM Tokyo Research Laboratory, where he works for the Services Software Engineering group. His research interests include software patterns, metrics, software quality engineering and empirical methods in software engineering. Dr. Nakamura is a member of the Association for Computing Machinery, the Institute of Electrical and Electronics Engineers, and the Information Processing Society of Japan. Alpana Prasad is an Assistant Director at Wolters Kluwer Corporate Legal Services, where she’s responsible for technical oversight and management of multiple offshore initiatives. She also works on other corporate initiatives and programs to improve platform and product development standards and best practices. Her research interests include analysis of new and emerging technologies, primarily in the Microsoft domain. She received her master’s in business administration from the Indian Institute of Management, Lucknow. She’s a member of the IEEE. Contact her at Wolters Kluwer Corporate Legal Services, 111 Eighth Ave., New York, NY 10011; [email protected]. Enrique Puertas Sanz (www.enriquepuertas.com) is Professor of Computing Science at Universidad Europea de Madrid, Spain. His research interests are broad and include topics like Artificial Intelligence, Adversarial Information Retrieval, Content Filtering, Usability and User Interface Designs. He has co-authored many research papers in those topics and has participated in several research projects in the AI field. Forrest Shull is a senior scientist at the Fraunhofer Center for Experimental Software Engineering in Maryland (FC-MD), where he serves as Director for the Measurement and Knowledge Management Division. He is project manager for projects with clients that have included Fujitsu, Motorola, NASA, and the U.S. Department of Defense. He has also been lead researcher on grants from the National Science Foundation, Air Force Research Labs, and NASA’s Office of Safety and Mission Assurance. Dr. Shull works on projects that help to transfer research results into practice, and has served as a principal member of the NSF-funded national Center for Empirically Based Software Engineering. He is Associate Editor in Chief

xiv

CONTRIBUTORS

of IEEE Software. He received a Ph.D. degree in Computer Science from the University of Maryland and can be reached at [email protected]. Michael Sthultz received his undergraduate education at Claremont Men’s College (B.A.) and the University of California, Berkeley (B.S.E.E.). His M.S. in Computer Science was completed at UNLV. He also holds industry certifications in Aþ, CCNP, CCAI, CEH, CLS, CLP, CNA, MCSE, and MCT. He has extensive industry experience in the areas of systems engineering, programming, network administration, management, and consulting. Michael is currently on the faculty of the College of Southern Nevada, teaching Cisco Networking Academy courses as well as Digital Forensics and Informatics. William Tepfenhart is author of several books on object orientation. He is currently an Associate Professor in the Software Engineering Department at Monmouth University investigating the potential of software solutions to enhance the effectiveness of collaboration in engineering endeavors. Prior to his entry to the academic world, he was employed as a developer and technologist at AT&T Laboratories where he worked on applications associated with the long distance network, establishment of engineering practices at a corporate level, and working with advanced object-oriented technologies. He had previously worked as a Senior Scientist at Knowledge Systems Concepts investigating the use of artificial intelligence systems for the USAF. Prior to that, he was an Associate Research Scientist at LTV where he worked on applications for manufacturing devices composed of advanced materials. Adam Trendowicz received a degree in computer science (B.Sc.) and in software engineering (M.Sc.) from the Poznan University of Technology, Poland, in 2000. He is currently a researcher at the Fraunhofer Institute for Experimental Software Engineering (IESE), Kaiserslautern, Germany in the Processes and Measurement department. Before that, he worked as a software engineering consultant at Q-Labs GmbH, Germany. His research and industrial activities include software cost modeling, measurement, and data analysis. Axel Wickenkamp is working as a scientist at the Fraunhofer Institute for Experimental Software Engineering in the department Processes and Measurement. His main research areas include static code analysis and software process models. Before joining the Fraunhofer Institute, he worked as a freelance consultant and software developer in industrial software development projects. Axel Wickenkamp received his degree in computer science (Diploma) from the University of Kaiserslautern. Nico Zazworka is currently a Ph.D. student in computer science at the University of Maryland. He received his Diploma Degree from the University of Applied Sciences

CONTRIBUTORS

xv

in Mannheim, Germany in 2006. His research interests are software engineering and information visualization. Marvin Zelkowitz is a Research Professor of Computer Science at the University of Maryland, College Park. He was one of the founders and principals in the Software Engineering Laboratory at NASA Goddard Space Flight Center from 1976 through 2001. From 1998 through 2007 he was associated with the Fraunhofer Center Maryland, where he was co-Director from 1998 through 2002. He has been involved in environment and tool development, measuring the software process to understand software development technologies, and understanding technology transfer. He has authored over 160 conference, book chapters and journal papers. He has a B.S. in Mathematics from Rensselaer Polytechnic Institute, and an M.S. and Ph.D. in Computer Science from Cornell University. He is a Fellow of the IEEE, recipient of the IEEE Computer Society Golden Core Award and the 2000 ACM SIGSOFT Distinguished Service Award, as well as several ACM and IEEE Certificates of Appreciation. He is also series editor of this series, the Advances in Computers. He can be reached at [email protected].

Preface

Welcome to volume 74 of the Advances in Computers, subtitled ‘Recent Advances in Software Development.’ This series, which began in 1960, is the oldest continuously published series of books that has chronicled the ever-changing landscape of information technology. Each year three volumes are published, each presenting five to seven chapters describing the latest technology in the use of computers today. In this current volume, we present six chapters that give an update on some of the major issues affecting the development of software today. The six chapters in this volume can be divided into two general categories. The first three chapters deal with the increasing importance of security in the software we write and provide insights into how to increase that security. The three latter chapters look at software development as a whole and provide guidelines for how best to make certain decisions on a project-level basis. Chapter 1, ‘Data Hiding Tactics for Windows and Unix File Systems’ by Hal Berghel, David Hoelzer, and Michael Sthultz, describes a form of security vulnerability generally unknown to the casual computer user. Most users today realize that viruses often propagate by embedding their code into the executable files (e.g., .exe files on Windows systems) of the infected system. By removing such programs, most viruses can be eliminated. However, there are storage locations in the computer which are not readily visible. A virus can be hidden in those areas (e. g., parts of the boot sector of a disk are currently unused, so can be used to hide malicious code), which result in them being harder to detect and eradicate. This chapter describes several of these areas where malicious code can hide to help it propagate its infection. In Chapter 2, ‘Multimedia and Sensor Security’ by Anna Hac´, Dr. Hac´ looks at the increasingly important area of sensor security. As computers become ubiquitous in our environment, an increasingly larger number of applications collect data from the world around us and process that data, often without human intervention (e.g., the use of RFID tags to track production, as described in the chapter by Roussos in volume 73 of the Advances in Computers). How do we ensure security and integrity of our collected data in an increasingly autonomous environment? In this chapter,

xvii

xviii

PREFACE

various mechanisms to detect vulnerabilities and ensure the integrity of the data are described. Anyone who has received email, and I am sure if you are reading this volume you either like email or are forced to use it, understands the problems with spam. I receive 20,000 email messages monthly. Fortunately, spam detectors on my computer systems weed out 17,000 of those messages giving me a tolerable level of perhaps 100 messages a day, of which maybe 30 are undetected spam. But how do spam detectors work and why are they so successful? Enrique Puertas Sanz, Jose´ Marıá Go´mez Hidalgo, and Jose´ Carlos Cortizo Pe´rez in Chapter 3, ‘Email Spam Filtering,’ provide an overview of spam and what can be done about it. In Chapter 4, ‘The Use of Simulation Techniques for Hybrid Software Cost Estimation and Risk Analysis’ by Michael Kla¨s, Adam Trendowicz, Axel Wickenkamp, Ju¨rgen Mu¨nch, Nahomi Kikuchi, and Yasushi Ishigai, the authors look at the problems in software cost estimation. Knowing how much a project is going to cost and how long it will take are crucial factors for any software development company. This editor, in 1982, was part of a study where some major developers claimed that understanding this was even more important than lowering the cost. They needed to know how many people to put on a project and not have extra workers doing very little. In this chapter, the authors describe their CoBRAÒ method for producing such estimates. Chapter 5, ‘An Environment for Conducting Families of Software Engineering Experiments’ by Lorin Hochstein, Taiga Nakamura, Forrest Shull, Nico Zazworka, Victor R. Basili, and Marvin V. Zelkowitz, looks at a crucial problem in doing research for improving the software development process. Scientific research in software engineering advances by conducting experiments to measure how effective various techniques are in improving the development process. Data needs to be collected, and in this case usually means defect, effort, and code generation activities from project participants. But programmers and analysts view such data collection as an intrusion on their activities, so the conundrum is to collect this data without the participants’ need to ‘actively participate.’ In this chapter, the authors describe an environment, where they have built an environment that automates, as much as possible, the data collection activities. In the final chapter, ‘Global Software Development: Origins, Practices, and Directions’ by James J. Cusick, Alpana Prasad, and William M. Tepfenhart, the authors discuss the current trends in software development becoming international. What do companies have to do in order to provide for a global software development

PREFACE

xix

workforce and how do they make the process work successfully? With an emphasis on outsourcing to India, this chapter also discusses outsourcing issues worldwide. I hope that you find these chapters interesting and useful. I am always looking for new topics to write about, so if you have any ideas in what should be covered in a future volume, please let me know. If you would like to write such a chapter, please contact me. I can be reached at [email protected].

Marvin Zelkowitz University of Maryland College Park, Maryland

Data Hiding Tactics for Windows and Unix File Systems HAL BERGHEL Identity Theft and Financial Fraud Research and Operations Center, University of Las Vegas, Las Vegas, Nevada

DAVID HOELZER Enclave Forensics, Las Vegas, Nevada

MICHAEL STHULTZ Identity Theft and Financial Fraud Research and Operations Center, University of Las Vegas, Las Vegas, Nevada

Abstract The phenomenon of hiding digital data is as old as the computer systems they reside on. Various incarnations of data hiding have found their way into modern computing experience from the storage of data on out-of-standard tracks on floppy disks that were beyond the reach of the operating system, to storage information in non-data fields of network packets. The common theme is that digital data hiding involves the storage of information in places where data is not expected. Hidden data may be thought of as a special case intentionally ‘dark data’ versus unintentionally dark data that is concealed, undiscovered, misplaced, absent, accidentally erased, and so on. In some cases, dark and light data coexist. Watermarking provides an example where dark data (an imperceptible watermark) resides within light data. Encryption is an interesting contrast, because it produces light data with a dark message. The variations on this theme are endless.

ADVANCES IN COMPUTERS, VOL. 74 ISSN: 0065-2458/DOI: 10.1016/S0065-2458(08)00601-3

1

Copyright © 2008 Elsevier Inc. All rights reserved.

2

H. BERGHEL ET AL. The focus of this chapter will be intentionally dark or hidden data as it resides on modern file systems – specifically some popular Windows and Unix file systems. We will extrapolate from several examples implications on the practice of modern digital forensics and the tools that are used in support thereof. One forensically interesting dimension of physical data hiding is those techniques that take advantage of the physical characteristics of formatted storage media to hide data. An early attempt to do this was illustrated by Camouflage (camouflage.unfiction.com) that hid data in the area between the logical end-offile and the end of the associated cluster in which the file was placed (called file slack or slack space). Although primitive, hiding data in file slack has the dual advantage that the host or carrier file is unaffected while the hidden data is transparent to the host operating system and file managers. The disadvantage is that the hidden message is easily recovered with a basic disk editor. The ability to hide data on computer storage media is a byproduct of the system and peripheral architectures. If all storage were bit-addressable at the operating system level, there would be no place to hide data, hence no physical concealment. But for efficiency considerations, system addressability has to be at more abstract levels (typically words in primary, and blocks in secondary). Such abstractions create digital warrens where data may go unnoticed or, in some cases, be inaccessible. We investigate some of these warrens below.

1. The Philosophy of Digital Data Hiding . . . . . . . . . . . . . . . . . . . . 3 1.1. The Concept of Data Hiding . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.2. Physical Aspect of Data Hiding . . . . . . . . . . . . . . . . . . . . . . . . . 3

2. Digital Storage and File Systems . . . . . . . . . . . . . . . . . . . . . . . 4 2.1. 2.2. 2.3. 2.4. 2.5.

Disk Structures . . . . . . . . . . . . . . . . . . . Virtual File Systems . . . . . . . . . . . . . . . . . Partition Organization . . . . . . . . . . . . . . . . ExtX . . . . . . . . . . . . . . . . . . . . . . . . . NTFS . . . . . . . . . . . . . . . . . . . . . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

. . . . .

4 6 7 8 8

3. Forensic Implications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 3.1. Fat16 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 3.2. NTFS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

4. Perspectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 5. Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

DATA HIDING TACTICS FOR WINDOWS AND UNIX FILE SYSTEMS

1.

3

The Philosophy of Digital Data Hiding 1.1

The Concept of Data Hiding

Digital data hiding is actually a cluster concept that spans many contexts. In modern times, nonphysical data hiding is usually associated with digital forms such as cryptography, steganography, and watermarking. Although related in the sense that they all are means to achieve secure or proprietary communications, there are differences among their three activities at a number of levels – some of which are quite subtle. To illustrate, the cryptographer’s interest is primarily with obscuring the content of a message, but not the communication of the message. The steganographer, on the other hand, is concerned with hiding the very communication of the message, while the digital watermarker attempts to add sufficient metadata to a message to establish ownership, provenance, source, and so on. Cryptography and steganography share the feature that the object of interest is embedded, hidden, or obscured, whereas the object of interest in watermarking is the host or carrier which is being protected by the object that is embedded, hidden, or obscured. Further, watermarking and steganography may be used with or without cryptography; and imperceptible watermarking shares functionality with steganography, whereas perceptible watermarking does not. Overviews exist for cryptography [13], steganography [9, 14], and watermarking [3].

1.2

Physical Aspect of Data Hiding

However, there is also a physical aspect of digital data hiding. In this case, digital storage locations are used to hide or conceal data. Obviously, these storage locations must be somewhat obscure or detection would be trivial. Examples include covert channeling (e.g., within TCP/IP packet headers or Loki’s use of the ICMP options field) or obscure or infrequently used addressable space in memory media. One of the earliest examples of this arose when microcomputers were first introduced. There was a difference between the number of tracks that a floppy drive controller could access (usually 81 or 82) and the number of tracks that were recognized by the operating system (DOS recognized only 80). The upper two tracks were used to hide data by vendors and hackers alike. For awhile they were even used for product licensing. A modern analogue might involve taking advantage of the physical characteristics of a storage medium to hide data. The steganographic tool Camouflage was such a program (camouflage.unfiction.com). Camouflage embeds messages in the file slack (see below). This simple approach to data hiding has the advantage that the characteristics of the host or carrier message remain unaffected but are transparent to the host

4

H. BERGHEL ET AL.

operating system and file managers. The disadvantage is that the hidden message is easily recovered with a hex-editor. Although this approach has not met with great success (and camouflage is no longer supported), it is a great segue into the art of data hiding by taking advantage of the physical characteristics of computer systems. The ability to hide data in computers is a byproduct of the system and peripheral architectures. If all storage were bit-addressable at the operating system level, there would be no place to hide data. For efficiency considerations, addressability has to be at more abstract levels (typically words in primary, and blocks in secondary). Such abstractions create digital warrens where data may go unnoticed or, in some cases, be inaccessible.

2.

Digital Storage and File Systems 2.1

Disk Structures

Digital storage encompasses a wide range of media including diskettes, hard drives, zip disks, USB flash drives, compact flash cards, CD-ROMs, DVDs, and so on. Since the structures of most of these media can be related to hard drives, a discussion of hard drive architecture will serve to illustrate the various data hiding mechanisms. Hard drive technology existed long before the advent of personal computers (although the early personal computers started out with only cassette tape or diskette storage!). As PCs evolved, the emphasis on backward compatibility and the need for user convenience (i.e., making data structures totally transparent to the user) greatly influenced the development of secondary and tertiary storage technology – both physically and logically. An unintended consequence has been the creation of many places where data can be intentionally hidden or unintentionally left behind. A functioning hard drive actually consists of a geometric structure and a set of nested data structures: hard drive, partition, file system, file, record, and field. Hidden data can be found at each of these levels. We will assume that the reader is familiar with basic hard disk geometry (cylinders, tracks, blocks, clusters, and sectors). These structures create areas on secondary storage devices where hidden data or data residue could exist. Figure 1 provides a graphical illustration of these digital warrens. In each example, the shaded area represents spaces within the structures where hidden data could reside. The following describes the various hiding mechanisms (as illustrated in Fig. 1), starting at the level of the hard drive itself and then working down through the set of nested data structures.


5

FIG. 1. Digital disk warrens.

Some hard drives can have a reserved area of the disk called the Host Protected Area (HPA) (see Fig. 1, item 1). Device Configuration Overlay allows modification of the apparent features provided by a hard drive, for example, the number of available clusters. This was designed to be an area where computer vendors could store data that is protected from normal user activities. It is not affected by operating system utilities (format, delete, etc.) and cannot be accessed without the use of a

6

H. BERGHEL ET AL.

special program that reconfigures the controller to access all physical blocks. It is not difficult, however, to write a program to access these areas, write data to them, and subsequently return the area to an HPA. This is an example of a hiding method that takes advantage of what is more or less a ‘physical’ feature of the drive architecture.

2.2

Virtual File Systems

At the next layer, common operating systems typically require that a hard drive be partitioned into virtual file systems before it can be used. This is true even if the entire hard drive is to be mapped onto a single partition. A partition is a set of consecutive blocks on a hard disk that appear to the operating system as a separate logical volume (drive for Windows vs directory or mount point for Unix). Note that there are several different types of partition formats. This discussion is confined to the partition format that has evolved from the original PC (often referred to as DOS partitions) and will not apply to Apple, xBSD, Sun Solaris, GPT partitioning, or multiple disk volumes. A recommended source for additional detail appears as a reference [6]. Even so, the various data hiding techniques at the data and file system levels are partition format independent. Every hard drive using a DOS partition has space reserved at the beginning of the drive for a Master Boot Record (MBR) (see Fig. 1, item 2). This will often contain the boot code necessary to begin the initial program load of an operating system and will always contain a partition table (provided we are dealing with partitioned media; e.g., floppy disks are not typically partitioned media while fixed disks are) defining the size and location of up to four partitions. Since the MBR requires only a single sector and partitions must start on a cylinder boundary, this results in 62 sectors of empty MBR space where data can be hidden. As disk sizes grew beyond the limitations of existing operating systems, there arose a need for more than four partitions on a single hard disk. Extended partitions (as opposed to primary partitions) were then designed that could contain multiple logical partitions. Each of these extended partitions contains a structure similar to the MBR, leaving another 62 sectors within each extended partition with the potential of harboring more hidden data. Extended partitions may contain at most one file system and one extended partition, so this design permits us to nest the extended partitions to satisfy our volume requirements. Of course, each iteration creates yet another convenient hiding place for data. If the partitions on a hard drive do not use up all of the available space, the remaining area cannot be accessed by the operating system by conventional means (e.g., through Windows Explorer). This wasted space is called volume slack (see Fig. 1, item 3). It is possible to create two or more partitions, put some data into


7

them, and then delete one of the partitions. Since deleting the partition does not actually delete the data, that data is now hidden.

2.3 Partition Organization Once partitions have been defined, we are ready to move up to the next layer and create an organizational structure for each partition. Before an operating system can store and access data within a partition, a file system must be defined. Modern operating systems support one or more native file systems. A file system allocates data in blocks (or clusters) where a block consists of one or more consecutive sectors. This allocation scheme allows a smaller number of references to handle larger amounts of data, but limits us to accessing data within the file system as block-sized chunks rather than sector-sized chunks. Overall, this tends to make storage and access far more efficient than referencing each individual sector. However, if the total number of sectors in a partition is not a multiple of the block size, there will be some sectors at the end of the partition that cannot be accessed by the operating system using any typical means. This is referred to as partition slack (see Fig. 1, item 4) and is another place where data can be hidden. Every partition contains a boot sector, even if that partition is not bootable. The boot sectors in non-bootable partitions (see Fig. 1, item 5) are available to hide data. Any space in a partition not currently allocated (i.e., unallocated space) to a particular file (see Fig. 1, item 6) cannot be accessed by the operating system. Until that space has been allocated to a file, it could contain hidden data. It is possible to manipulate the file system metadata that identifies bad blocks (e.g., the File Allocation Table in a FAT file system or $BadClus in NTFS) so that usable blocks are marked as bad and therefore will no longer be accessed by the operating system. Such metadata manipulation (see Fig. 1, item 7) will produce blocks that can store hidden data. Disk slack (see Fig. 1, item 8) is a byproduct of a strategy to accelerate file management. Modern operating systems write data in complete ‘blocks’ where a block could be a sector (the minimal addressable unit of a disk) or a cluster (same concept as block in Microsoft’s terms). If a file is not an exact multiple of the sector size, the operating system must pad the last sector and, in some cases (with older operating systems), this padding is data from memory (hence the historical term ‘RAM slack’). Modern operating systems tend to pad this area with nulls. If the total amount of data written does not fill an entire block, the remainder of the block from the sector boundary of the last sector within the block actually used by the file to the actual end of the block will remain unused and will likely contain data from a previously deleted file ( file slack). It may also be effectively used to hide ephemeral data.

8

H. BERGHEL ET AL.

All of the above applies to nearly every file system in common use today, including FAT/FAT32, NTFS, and Linux Ext-based file systems. There are some potential data hiding places in Linux file systems that require a more detailed description.

2.4

ExtX

Ext2 and Ext3 (ExtX) file systems are divided into sections called block groups. Block groups are used to store file names, metadata, and file content. Information about block group size and configuration is stored in a superblock at the beginning of the file system, copies of which are scattered throughout the partition. The block following the superblock (if present) or the first block in every group (if not present) contains a group descriptor table with group descriptors describing the layout of each block group. An ExtX superblock has 1,024 bytes allocated to it and the last 788 bytes are unused. There also might be some reserved area behind the superblock, depending upon the block size. We call this superblock slack (see Fig. 1, item 9). There is a reserved area behind the ExtX group descriptor since the group descriptor is only 32 bytes long and the block bitmap that follows it must start on a block boundary. This means there is a minimum of 992 bytes (1,006 if you count the padding at the end of the group descriptor) where data could be hidden and more if the block size is larger than 1,024 bytes. We refer to this as ExtX group descriptor slack (see Fig. 1, item 10). ExtX directories are like any other file and are allocated in blocks. The space between the last directory entry and the end of the block is unused and can be used to hide data. This is directory slack (see Fig. 1, item 11). Figure 2 is a graphical illustration of the relative volatility of the various data hiding areas discussed above (cf. also [10]). The degree of persistence of the hidden data is dependent upon the characteristics of the particular area where it is hiding and the type of disk activity that has occurred since the data was written there. Figure 2 illustrates the relative persistence through normal disk activity and possible repartitioning and/or re-formatting. The numbers in the figure correspond to the numbered items in Fig. 1.

2.5

NTFS

NTFS file systems also offer some unique opportunities for data hiding. The NTFS file systems used today contain innovations that provide efficient file access (for instance, B-Tree organization of files within directories) and readily accessible metadata files to manage disk organization (Microsoft’s version of resource forks called Alternate Data Streams), and some other small file storage oddities as well.


9

P = persistent E = ephemeral Normal disk use

P (1) (2) (3) (4) (5) (7) (8)1 (9) (10)

Re-partition (requires format) (can shrink, extend, or add)

P (1) (2) (5)2,3 (8)4 (9)2 (10)2

1 2 3 4 5

E (3)5 (4)5 (7)

E (6) (11)

Re-format existing partition

P (1) (2) (3) (4) (5) (8)4 (9) (10)

E (7)

if file is not changed if partition is not moved if partition is not made bootable becomes ephemeral with normal disk use becomes ephemeral with normal disk use if new partition and file system extends into this space FIG. 2. Relative volatility of data hiding areas.

When seeking to hide data, there are various strategies that might be employed. As mentioned in a more general sense, metadata manipulation may be used to conceal covert data in bad clusters ($BadClus). In fact, this same concept can be extended easily on an NTFS file system by working directly with the $Bitmap file.

10

H. BERGHEL ET AL.

The $Bitmap file contains a complete map marking the allocation status of every addressable cluster in the partition. Should a consistency check be run, it would become obvious should someone modify this table to hide data, but otherwise this provides a wonderful avenue for hiding data in a way that allows the data to persist for the life of the file system. Depending upon the purpose, these are far better approaches than using file slack which persists only for the life of the file. NTFS provides some other nooks and crannies. For instance, Alternate Data Streams are actually additional $FILE entries associated with a parent file record within the Master File Table. We could not find Microsoft documentation regarding the number of alternate data streams that may be associated with a file or folder, but empirical testing conducted by Jason Fossen (www.fossen.net) suggests that the maximum is 4 106 regardless of the size of the ADSs themselves. These streams are not identified by typical file management tools (e.g., Windows Explorer), and so are hidden at that level. However, several utilities are available that report and manipulate alternate data streams [1]. Alternate data streams persist for the life of the attached file or folder as long as that file or folder remains in an NTFS file structure. Small files also offer some interesting possibilities, especially when considered in conjunction with alternate data streams. NTFS has a rather unusual capability in that if a file is so small that the entire content of the file can fit within the boundaries of the Master File Table entry for the file, NTFS will store the file there. This is, of course, a convenient place to hide data. But it becomes even more interesting when a file is deleted. When a file is deleted, the clusters that were in use are released to the file system for reallocation. This includes the MFT entry itself. What if one were to create several thousand files, thus consuming several thousand MFT entries; once these files were created, a final file could be created that fits entirely within the MFT. All of these files are now deleted. In essence, we have created a piece of hidden disk space that resides within an allocated file ($MFT and $MFTMirror) that will persist until enough files are created to reuse that particular MFT entry. For further detail, see [2].

3.

Forensic Implications 3.1

Fat16

The implications of this type of intentional data hiding can be serious in the context of forensic analysis [4], [11], and [12]. Typically, forensic analysis of systems reveals that bad actors do not often take any extraordinary means to hide data beyond, perhaps, either wiping the media or encrypting the data. In fact, in most cases, the data is not even encrypted or wiped. What impact would a deep knowledge of the on-disk structures coupled with a desire to hide data have on an analysis?


11

To consider this, we have created several sample disk images and have embedded two pieces of data using the methods discussed in this chapter. After embedding the data, we used a tool that is commonly used by law enforcement for forensic analysis to determine how easily an analyst could uncover this hidden data. The data that was hidden was a text string, ‘Hidden Message,’ and a GIF image containing an image of the word ‘Hidden.’ Please understand, of course, that if the investigator already knows something of what he is looking for, for example, the word ‘Hidden,’ the difficulty of recovering this data is trivial. What we are seeking to measure is whether or not the tool alerts the analyst to the presence of data in unusual locations and how likely it is that the analyst would discover the materials. The first test was run using FAT16. As a form of control, an image file was copied to the disk using the typical file system tools. Data was hidden using two simple methods: First, the FAT16, when formatted, automatically preferred a cluster size of 4 096 bytes. The result of this was that the boot sector of 512 bytes is immediately followed by three empty sectors. Our ‘Hidden Message’ text was inserted here. In order to conceal the presence of the GIF image, the first FAT was modified so that clusters 24 through 29 were marked as bad (see Fig. 3). Finally, the GIF image was placed onto the disk beginning in cluster 24. With our data hidden, we used AccessData’s Forensic Toolkit (better known as FTK) to acquire an image of the drive and perform data carving and full text indexing (see Fig. 4).

FIG. 3. File allocation table with clusters 24–29 marked ‘bad.’

12

H. BERGHEL ET AL.

FIG. 4. Forensics toolkit results showing hidden GIF file.

Of particular interest to us were the results from the file carver. File carvers are forensic tools (or data recovery tools) that analyze the data on a drive (typically sector by sector or block by block) without any regard for the actual logical organization of the disk. Each sector or block is then checked for known file signatures and, if one is found, the data is extracted or marked appropriately. One of the reasons that a GIF image was selected is that it has a very standard and easily recognizable ‘magic number’ or fingerprint: Almost every one of them begins with the marker ‘GIF89a.’ While FTK did find the file and mark it as a ‘Lost File Chain’ marked as bad sectors, it did not successfully identify this as an image. Even though the ‘hidden message’ is sitting in what should be a completely barren segment of the drive, FTK makes no special mention of this text. Unless the analyst is in the habit of examining all reserved sectors for additional data or already knows to search for a keyword of ‘Hidden,’ it is very unlikely that this data would be found. From our experience, this is typical behavior for a forensic toolkit. In short, it is unusual for any forensic analysis tool currently on the market to draw the analyst’s attention to a piece of data that is residing in an atypical location.

3.2

NTFS

The next set of tests was performed using an NTFS file system with a cluster size of 4096 bytes. Data was hidden using several of the techniques discussed. First, in the reserved area between the primary partition table and the first partition, ‘Hidden


13

Message’ was again embedded. Since there was additional space, we also embedded our image file, but this time the file was not embedded beginning at the beginning of a sector. Many file carvers speed up their operation by examining only the first few bytes of a sector or only the first sector in a cluster. As an additional test, the $Bitmap file was modified to mark the final clusters of the volume as ‘In Use’ and the GIF image was copied into these now reserved clusters. The ‘Hidden Message’ was also embedded using the Alternate Data Stream technique discussed. To accomplish this, a host file was created followed by 1,000 associated streams. The data that we wished to conceal was then copied into what amounts to stream 1,001 and the host file was then deleted. Finally, additional files were copied onto the drive to obscure the original host file MFT entries, but with the cushion of 1,000 alternate data streams, the original hidden data would still be untouched. With all of these tasks completed, the drive was imaged and analyzed using FTK. FTK was able to identify and carve the hidden data in the slack space between the partition table and the first partition, even though it was not on a sector boundary. Unfortunately, while it was successful with the image file, it still failed to ‘notice’ the hidden text. What if the file that was hidden did not match a known fingerprint or were encoded in some way? FTK would fail to notify the analyst. It was also successful in identifying the image file tucked away at the tail end of the disk in space that we ‘reserved.’ While this is good, there was no notification that space was marked ‘In Use’ that was not actually allocated to any disk structure or file. Obviously, the same problem exists as does for the gap between the partition table and the partition. What about the alternate data streams? FTK, surprisingly, made no mention of the fact that there were still ~800 remnants of alternate data streams floating around in the MFT and, of course, did not notify us to the presence of the ‘Hidden Message’ unless we already knew what to search for. Overall, this means that for us to be successful today with forensic investigations, we need really sharp analysts who are willing to go above and beyond to find data when we are dealing with clever malcontents. Our tests were performed on a small drive (256 MB). Obviously, hunting down data on a 500 GB drive is well-nigh impossible without good tools and good initial information. In the long run, as drives continue to increase in size and those who desire to conceal activities become better at their trade, the forensic community will be at a greater and greater disadvantage unless we become proactive in this ‘Arms Race’ and move away from strict signature-based analysis of media and start building in some sort of anomaly detection capability.

14

H. BERGHEL ET AL.

4.

Perspectives

It should be pointed out that this discussion includes methods of hiding data only within the media and file system structure and does not address other data hiding methods such as: l

l

l

l

l

Altered BIOS parameters The system BIOS traditionally stores the physical configuration of the drives that are connected. Typically, the BIOS is set to automatically detect the drive parameters; however, it can be configured manually. By doing so, it is possible to create a sort of pseudo HPA area beyond what is apparently the end of the disk according to the BIOS. Registry entries using new keys or unused keys There are a variety of technologies available that allow one to create a virtual file system within a file on the system. With some minor modification, it is trivial to create such a file system that is stored, not within a file, but within a set of registry keys. Large disks would be prohibitively slow to access and have a serious impact on system performance due to memory utilization. Swap files While swap files are in fact files that are known to exist on a system, if the swap mechanism is disabled or otherwise controlled, the swap space can be used for the storage of arbitrary data. While it is true that swap space is frequently analyzed by forensic investigators, it is typically viewed as a memory dump. If a portion of the data is instead formatted as a virtual encrypted disk, it is highly likely that this data will go unnoticed, dismissed as random junk. Renamed files (e.g., as .dll) Decidedly nontechnical, this remains an extremely effective way to hide almost any kind of data. Malicious code authors have been using this same technique to great effect for many years, concealing the malicious code as what appears to be a system DLL. This will likely not fool a forensic investigator, but a casual user or administrator will often overlook files masked in this way. Binding of one executable file to another Another very popular technique with malicious code authors is to redirect execution from one application to another. In some ways, this is exactly how appending viruses of the early nineties functioned in that the malicious


l

l l l

l l

15

code was appended to the existing executable and then the executable header was modified or the initial instruction modified to redirect execution to the malicious code. Following execution of the malicious code, control was handed back to the original code. These days redirection is accomplished in a variety of ways, for instance through DLL injection, which could then allow a user to subvert the typical input/output system for file and data access. Steganography This well-known technique for hiding data in plain sight is fast gaining in popularity. One of the most interesting applications of this is the StegFS driver for Linux (http://www.mcdonald.org.uk/StegFS/) which allows the user to create layers of hidden file systems on top of an existing Linux file system. Hiding data within documents (e.g., as metadata or using a white font) Hiding data within html files Merging Microsoft Office documents This is another steganographic technique. While some recent versions of software have made this more difficult (for instance, newer versions of Microsoft Word will actually display the white on white text as a grayed out text), the hiding of data in metadata or through other techniques is still possible. For instance, one tool embeds data by manipulating the white space at the end of existing lines within a document. Encrypted files Compressed files These two are perhaps the most direct way to store data on a system in a somewhat unreadable format, though some may contend with how well hidden the data actually is. From the point of view of someone who is looking for ‘unusual’ data, a compressed or encrypted file would be of interest. From the point of view of someone who is trying to run a file carver or a string match against a set or large disks, it is quite likely that these methods will be sufficient to hide the data from an investigator. For the compression, simply using a common compression tool would likely not be enough to day. Many tools are smart enough to take these files apart or alert the operator that a password is required. Using a older technology like LHARC could prove quite sufficient, though. This format (and others) could still be recognized, but the investigator’s tools are far less likely to understand how to decompress the data.

16

H. BERGHEL ET AL.

5.

Conclusion

Knowing how data can be hidden within the media and file system structure means knowing how that data can be found. Note that we are talking about only the data hiding mechanisms that have been discussed here; methods such as encryption and steganography present their own sets of analysis problems. Many of those who attempt to temporarily hide data or use a computer with nefarious intent are aware that there are ways in which this hidden data can be found. They will therefore use one of the available ‘disk wiper’ utilities in an attempt to eliminate the evidence. What they are not aware of is that many of these utilities are ineffective in eliminating all hidden data. See [2] for more information. A forensic analysis tool can be as simple as a hex-editor. While effective, this approach is very labor intensive given the size of today’s hard drives. There are many commercial and open source digital forensic tools available that will automate this process. However, one must exercise caution when using these tools, since not all of them are equally effective in finding all types of hidden data. It is often advisable to use more than one of these tools to perform a digital forensic investigation. For further information, see [5], [7], and [8]. Finding hidden data is further complicated by the fact that there are a number of antiforensic tools being developed. One source is the research being done by the Metasploit Project (www.metasploit.com/projects/antiforensics). An example is their Slacker tool that automatically encrypts and hides a set of data within the slack space of multiple files that are known to be unlikely to be changed. Data thus hidden cannot be detected by currently available digital forensic analysis software. Data hiding becomes an increasingly important topic as the sophistication of information technologists on both sides of the law increases.

References [1] Berghel H., and Brajkovska N., 2004. Wading through alternate data streams. Communications of the ACM, 47(4): 21–27. [2] Berghel H., and Hoelzer D., What does a disk wiper wipe when a disk wiper does wipe disks. Communications of the ACM, 49(8): 17–21. [3] Berghel H., and O’Gorman L., 1996. Protecting ownership rights through digital watermarks. IEEE Computer, 29(7): 101–103. [4] Caloyannides M. A., 2001. Computer Forensics and Privacy. Artech House, Norwood, MA. [5] Carrier B., and Winter B., 2003. Defining digital forensic examination and analysis tools using abstraction layers. International Journal of Digital Evidence, 1(4): 1–12. [6] Carrier B., 2005. File System Forensic Analysis. Addison-Wesley, Upper Saddle River, NJ.


17

[7] Carvey H., 2005. Windows Forensics and Incident Recovery. Addison-Wesley, Upper Saddle River, NJ. [8] Casey E., 2002. Handbook of Computer Crime Investigation. Academic Press, San Diego, CA. [9] Cole E., 2003. Hiding in Plain Sight: Steganography and the Art of Covert Communication. Wiley Publishing, Indianapolis. [10] Farmer D., and Venema W., 2005. Forensic Discovery. Addison-Wesley, Upper Saddle River, NJ. [11] Kruse I. I., Warren G., and Heiser J. G., 2002. Computer Forensics, Incident Response Essentials. Addison-Wesley, Upper Saddle River, NJ. [12] Nelson B., et al., 2006. Guide to Computer Forensics and Investigations. 2nd edition Course Technology, Florence, KY. [13] Singh S., 2000. The Code Book. Anchor Books, New York. [14] Wang H., and Wang S., Cyber warfare: steganography vs. steganalysis. Communications of the ACM, 47(10): 76–82.

Multimedia and Sensor Security ANNA HAC´ Department of Electrical Engineering University of Hawaii at Manoa, Honolulu Hawaii 96822

Abstract Multimedia and sensor security emerged as an important area of research largely due to growing accessibility of tools and applications through different media and Web services. There are many aspects of multimedia and sensor security ranging from trust in multimedia and sensor networks; security in ubiquitous databases, middleware, and multi-domain systems; privacy in ubiquitous environment and sensor networks; and radio frequency identification security. Particularly interesting are multimedia information security, forensics, image watermarking, and steganography. There are different reasons for using security in multimedia and sensors that depend on the method of access, the type of accessed information, the information placement and the availability of copying, sensitivity of protected information, and potential ways for corruption of data and their transmission. Protection of image and data includes watermarking, steganography, and forensics. Multi-domain systems, middleware, and databases are used for both local and distributed protections. Sensor networks often use radio frequency identification tags for identification. Both trusted hardware and software are needed to maintain multimedia and sensor security. Different applications require various levels of security often embedded in the multimedia image. In addition, a certain security level is needed for transmission of the application. Sensors use different security for data gathering depending on the type of data collected. Secure transmission is needed for sensor data. We present a comprehensive approach to multimedia and sensor security from application, system, network, and information processing perspective. Trusted software and hardware are introduced as support base for multimedia and sensor security.


19


A. HAC´

20 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15.

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . Multimedia Systems and Applications . . . . . . . . . . . . . . Multimedia Security . . . . . . . . . . . . . . . . . . . . . . . . Digital Watermarking . . . . . . . . . . . . . . . . . . . . . . . Steganography . . . . . . . . . . . . . . . . . . . . . . . . . . . Computer Forensics . . . . . . . . . . . . . . . . . . . . . . . . Sensor Networks . . . . . . . . . . . . . . . . . . . . . . . . . . Security Protocols for Wireless Sensor Networks . . . . . . . . Communication Security in Sensor Networks . . . . . . . . . . Sensor Software Design . . . . . . . . . . . . . . . . . . . . . . Trusted Software . . . . . . . . . . . . . . . . . . . . . . . . . Hardware Power-Aware Sensor Security . . . . . . . . . . . . . Trusted Hardware . . . . . . . . . . . . . . . . . . . . . . . . . Sensor Networks and RFID Security . . . . . . . . . . . . . . . Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . .

. . . . . . . . . . . . . . .

. . . . . . . . . . . . . . .

. . . . . . . . . . . . . . .

. . . . . . . . . . . . . . .

20 21 24 26 28 29 30 33 34 35 35 36 36 37

37 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

1.

Introduction

Multimedia comprises of voice, data, image, and video, protection of which becomes increasingly important in the information age. There are many security levels depending on the application and the method in which the application is executed. Multimedia applications include both software and hardware, which are often the integral parts of the application in addition to the system software and hardware used by the application. Both software and hardware security are crucial to multimedia application performance and execution as well as to the multimedia information delivered. We will describe trusted software and hardware needed to protect multimedia application and its execution in the system. Internet and Web-based applications have become an integral part of every day life and security in accessing and executing these multimedia applications is necessary for trustworthiness of the information sent and received. The methods used to preserve multimedia information security include forensics, image watermarking, and steganography.

MULTIMEDIA AND SENSOR SECURITY

21

Sensors have also become a part of every day life and of the growing new developments and applications. Sensor applications include data being gathered and transferred as well as the multimedia information. Trusted software and hardware are needed, security and trust in multimedia and sensors is important, multimedia and ubiquitous security is emerging, and the security in ubiquitous databases for information access has been developed. In sensor networks, RFID (radio frequency identification) security and multimedia information security are needed for secure transmission of information. We describe multimedia systems and applications, sensor networks, security protocols for wireless sensor networks, communication security in sensor networks, sensor software design, trusted software, hardware power-aware sensor security, trusted hardware, sensor networks and RFID security, forensics, image watermarking, and steganography.

2.

Multimedia Systems and Applications

Multimedia systems and applications are used in the representation, storage, retrieval, and dissemination of machine-processable information expressed in multimedia, such as voice, image, text, graphics, and video. High capacity storage devices, powerful and economical computers, and high speed integrated services digital networks, providing a variety of multimedia communication services made multimedia applications technically and economically feasible. Multimedia conference systems can help people to interact with each other from their homes or offices while they work as teams by exchanging information in several media, such as voice, text, graphics, and video. Participants can communicate simultaneously by voice to discuss the information they are sharing. The multimedia conference system can be used in a wide variety of cooperative work environments, such as distributed software development, joint authoring, and group decision support [29]. In multimedia conferencing, each participant has a computer that includes high-resolution screen for computer output, keyboard and pointing device, microphone and speaker, and camera and video monitor. Parts of each participant’s screen can be dedicated to display shared space where everyone sees the same information. Voice communication equipment can be used by the conference participants for discussion and negotiation. Video communication can add illusion of physical presence by simulation of face-to-face meeting. Video teleconferencing is valuable when nonverbal communication, in the form of gestures and facial expressions, is an important part of the discussion and negotiation that takes place. Video communication

22

A. HAC´

can be a useful enhancement to the multimedia conferencing, but is less critical than voice communication and the ability to share information and software. Electronic blackboards allow joint manipulation of shared image, but are subject to the same limitations as the physical blackboard. The participant’s ability to access and manipulate information dynamically by making use of powerful computerbased tools is the distinguishing characteristics of the multimedia conferencing. The goal of the multimedia conference systems is to emulate important characteristics of face-to-face meetings. These systems allow group of users to conduct meeting in real time and the conference participants can jointly view, edit, and discuss relevant multimedia documents. There are many applications of multimedia conferencing systems, ranging from software development to medical image analysis, and to making assessments and decisions in real time [33, 54]. Security of multimedia conferencing systems is very important since the processing occurs in real time, and in case of some applications, some crucial, even life-saving decisions are made. Multiple compression algorithms allow for having quality performance in realtime video through radio channels. In these algorithms, the computational complexity is traded against image quality. Multimedia compression includes data and text compressions by using semantic analysis, audio compression by using inaudible audio masks, image compression by using graphic formats and blocks, and video compression by using motion pictures and streaming and mobile applications. The characteristics of modern embedded systems are the capability to communicate over the networks and to adapt to different operating environments [28]. Embedded systems can be found in consumer devices supporting multimedia applications, for example, personal digital assistants, network computers, and mobile communication devices. The low cost, consumer-oriented, and fast time to market objectives characterize embedded system design. Hardware and software codesigns are used to support growing design complexity [19, 20]. Emerging embedded systems run multiple applications such as Web-browsers, audio and video communication applications, and require network connectivity [10]. Networked embedded systems are divided into l l

Multifunction systems that execute multiple applications concurrently, and Multimode systems that offer the users a number of alternative modes of operation.

In the multifunction systems, the embedded systems can execute multiple applications concurrently [36]. These applications include capturing video data, processing audio streams, and browsing the Web. Embedded systems must often adapt to the changing operating conditions. For example, multimedia applications adapt to


23

the changing network rate by modifying video frame rate in response to network congestion. Different network rate and compression techniques are often determined by the network load and quality of service feedback from the user applications. Embedded multimode systems experience a number of alternative modes of operation. A mobile phone is designed to change the way it operates to accommodate different communication protocols supporting various functions and features. Flexible, multimode devices are used in applications such as electronic banking and electronic commerce. Depending on the type of connection and the security level required, devices use different encryption algorithms when transmitting data. Embedded devices need to communicate over the networks and to adapt to different operating environments [19, 20, 35]. Multimedia systems concurrently execute multiple applications, such as processing audio streams, capturing video data and Web browsing. These multimedia systems need to be adaptive to changing operating conditions. For instance, in multimedia applications, the video frame rate has to be adjusted depending on the network congestion. Audio streams different compression techniques are the function of the network load. In both home and industrial applications there are sensor and actuator devices which can be remotely controlled and maintained via Internet. These applications need Web-based security to maintain the accessed information and the data changes and updates that may be introduced. Multimedia is supported by MPEG (Moving Picture Experts Group) standards: MPEG-1, MPEG-2, MPEG-4, MPEG-7, and MPEG-21. MPEG-1 includes video and audio compression standards. MPEG-2 includes transport, video, and audio standards for broadcast quality television. MPEG-4 supports DRM (digital rights management). MPEG-7 is used to describe multimedia content, and MPEG-21 supports multimedia framework. Broadband and streaming video delivery as well as video storage require MPEG-1, MPEG-2, and MPEG-4. Content-based retrieval, adaptation, and multimedia filtering use MPEG-4 and MPEG-7. MPEG-7 allows for semantic-based retrieval and filtering, and MPEG-21 allows for media mining on electronic content by using digital items. Multimedia framework supported by MPEG-21 allows the participants to exchange digital items, which include media resources, learning objects, rights representations, reports, and identifiers. Network security is critical to multimedia communication and access. There are several security challenges to Internet transmission. Denial of service (DoS) attacks may occur when the session protocol proxy server or voice-gateway devices receive many unauthentic packets. A hijacking attack occurs when a participant registers with an attacker’s address instead of the user’s legitimate address. Eavesdropping is an unauthorized interception of voice packets or decoding of signaling messages. Packet spoofing occurs when an attacker impersonates a legitimate

A. HAC´

24

participant transmitting multimedia information. Replay occurs when a message is retransmitted causing the network device to reprocess the same message again. Message integrity ensures that the message received is the same as the message that was sent.

3.

Multimedia Security

Multimedia security includes protection of information during transmission as well as content security of the image and data, protection of intellectual property, and support for trustworthiness. Multimedia content is protected through data authentication and confidentiality that ensures privacy of multimedia transmission. Protection of a multimedia image is important once it is posted on a Web site. The multimedia image can be easily downloaded by unauthorized users in a very short period of time after it has been posted. Having watermarks embedded in multimedia images does not prevent unauthorized downloading of a file. Putting copyright notices into image source code does not protect the multimedia image from being downloaded by unauthorized users. Encryption of the image ensures that it cannot be saved to a disk or linked directly from the other Web sites. Protection of multimedia images by using encryption is available for both JPEG (joint photographic experts group) and non-animated GIF (graphics interchange format) files. We present multimedia security frameworks including image and communication security. DRM describes, protects, and monitors all forms of access and use to protect multimedia from illegal distribution and theft. A DRM system links user rights to multimedia access for viewing, duplication, and sharing. Security services preserve data integrity and confidentiality, support non-repudiation by protecting against denial by the users during communication, and maintain access control and authentication. Multimedia confidentiality is preserved by using encryption supporting real-time access and communication as well as image compression [4, 51, 62]. Encryption algorithms use keys to maintain security of the system. The strength of a cryptographic system depends on the encryption algorithm used, the system design, and the length of the key. The length of the key reflects the difficulty for an attacker to find the right key to decrypt a message. The longer key requires more combinations to be checked in a brute force attack to match the key. The key length is given in bits and the number of possible keys that can be used grows exponentially with the increase of key length. DES (data encryption standard) is based on Feistel Cipher Structure, which is a block cipher with the plaintext of 64-bit blocks and 56-bits key [83]. The key length


25

is increased to 112/168 bits in triple DES and to 128/192/256 bits in AES (advanced encryption standard) with 128-bit data. Both DES and AES require significant computational resources and use block-based structures that introduce delay in real-time communications. In RSA (Rivest, Shamir, and Adleman), the key length is variable, and commonly used key length is 512 bits [70]. The block size in RSA is variable. In MD5 (message digest standard), the message is processed in 512-bit blocks, and the message digest is a 128-bit quantity [69]. Lossless compression is used in applications where both the original file and decompressed information need to be identical. The original file can be derived from the compressed information after lossless compression algorithms have been applied. In many multimedia applications, lossless compression, which requires large compressed files, is expensive and unnecessary. Examples of files using lossless compression are GIF, BMP (bitmap), PNG (portable network graphics), and TIFF (tagged image file format). Lossy compression is used to compress multimedia image, audio, and video, in such a way that the retrieved decompressed multimedia information is a fraction of lossless uncompressed multimedia while retaining acceptable quality. Because lossy compression eliminates permanently redundant information from the multimedia image, thus, repeatedly compressing and decompressing a multimedia file progressively decreases decompressed file quality. JPEG file uses lossy compression. Examples of lossy compression methods include DCT (discrete cosine transform), VQ (vector quantization), fractal compression, and DWT (discrete wavelet transform). Multimedia authentication requires sensitivity, robustness for lossy compression, security, portability, localization to detect changed area, and recovery to approximate the original in its particular area that was changed. Robust digital signature verifies information integrity endorsed by the signed owner. Digital signature can use content-related feature codes and distinguish content-preserving operations from malicious attacks. SARI (self authentication and recovery images) detect the manipulated area in multimedia work, and recover approximate values in the changed area. Content-related feature codes use syntax in the form of objects’ composition and semantics to specify multimedia objects. Syntax describes shape, texture, and color of multimedia objects. Semantic authentication describes types of objects and their relationships. Semantic authentication also includes events and the scene, where the objects are located. A multimedia security framework using randomized arithmetic coding [24, 25] allows for protection, encryption, and conditional access. The randomized arithmetic coding is employed in JPEG 2000 security applications. Image authentication, robustness, and security are explored in [80] by using an image hash function based on Fourier transform. A framework for generating a hash consists of feature extraction that generates a key-dependent feature vector from

A. HAC´

26

the multimedia image, quantization of the generated feature vector, and finally compression of the quantized vector. A multimedia encryption scheme that does not rely on the security strength of an underlying cryptographic cipher is introduced in [91]. A pseudo-random key hoping sequence is generated that prevents a chosen-plaintext attack. The method ensures high semantic security by enhancing MHT (Multiple Huffman Tables) encryption scheme. An evaluation of MHT schemes by using chosen-plaintext attacks is described in [102]. An encryption scheme for MPEG-4 FGS (fine granularity scalability) video coding stream is proposed in [95]. Compression efficiency is preserved by processing encrypted FGS stream on the cipher text. A peer-to-peer (P2P) interactive multimedia communication is described in [8]. Streaming multimedia traffic in wireless communication under SRTP (secure realtime transport protocol) and the key management protocol MIKEY (multimedia Internet KEYing) are explained. Authentication methods use message authentication code or a signature. An agent-based multimedia security system is proposed in [46]. A hierarchy of hosts supports multilevel security groups. Security service agents are created and dispatched to security groups. Security problems related to multimedia multicast are described in [59, 60, 93]. Additional bandwidth for multicast transmission with multimedia security protection increases demand on distributed system resources. A multicast packet authentication scheme is presented in [71]. Mobile multicast security is discussed in [22]. Multimedia security in FTTH (fiber to the home) connectivity in passive optical networks is explained in [73]. Proposed security enhancements include wavelength hopping and codes sequencing in downstream traffic in P2MP (point to multi-point) network. Multilevel 2D (2-dimensional) bar codes for high-capacity storage applications are described in [84]. A print-and-scan channel is adapted to multilevel 2D bar codes communication. Fully format compliant scrambling methods for compressed video are proposed in [37]. A decoder can decode the secured multimedia stream in fully format compliant scrambling method. Security problems for video sensors are discussed in [42]. Multimedia security for sensor networks includes scaling down security features to accommodate smaller sensors’ size and processing capabilities.

4.

Digital Watermarking

Watermark is an additional information used to protect images. A watermark can be a copyright notice on the picture, a date-stamp on photographs taken, additional names and comments on the pictures, and a company logo on a document.


27

Digital watermarking uses hidden messages to copyright digital images, video, and audio by employing sequence of bits carrying information characterizing the owner of a multimedia item. A watermark can contain any useful information that identifies copyright protection. In addition, there are watermarks that indicate other types of ownerships. Watermarking is used to embed visible and invisible information in the form of code into multimedia to protect the image and to identify its ownership. Watermark must be very difficult or impossible to remove. Visible watermark must be nonobstructive. The invisible watermark should not visually affect the image content, and must resist image manipulations. Watermarking on multimedia content embeds watermark information into the multimedia image by using coding and modulation. Coding is done by scrambling with the use of cryptographic keys and error correction coding. Modulation employs TDMA (time division multiple access), FDMA (frequency division multiple access), CDMA (code division multiple access), or spread spectrum. Spread spectrum uses DFT (discrete Fourier transform), DCT, and wavelet transforms. JND (just noticeable distortion) is the maximum amount of invisible changes in a specific pixel (or frequency coefficients) of an image. JND employs luminance masking with the threshold specified by light adaptation of human cortex, where the brighter background increases the luminance masking threshold. JND also applies contrast masking, in which the visibility of one image component is reduced by the presence of another image component. The contrast masking is the strongest when both image components are of the same spatial frequency, orientation, and location. Multimedia security can be compromised through unauthorized embedding, where the attacker is able to compose and embed the original watermark image, which is either given away by the owner or extracted by the attacker. Standard cryptographic techniques and content-related watermarks help to prevent unauthorized embedding. Multimedia security can also be compromised by unauthorized detection of watermark image that was intended to remain sealed from the attacker. This unauthorized detection can be prevented by using encryption and decryption techniques. Unauthorized removal is another multimedia security attack where the watermark is eliminated or masked. Spread spectrum techniques can be used to prevent unauthorized removal. Finally, in the system-level multimedia security attack, the weakness in using the watermark is exploited. By compromising the system control over the watermark image, the attacker can gain access to the watermarked multimedia work. To prevent system-level attack, a device scrambling watermark multimedia work makes the watermark image undetectable to the attacker. A descrambling device inverts the watermark multimedia work. There are also attacks distorting watermark image and affecting synchronization between

A. HAC´

28

multimedia audio and video. Ambiguity attacks pretend that the watermark image is embedded where no such embedding occurred. The owner of the multimedia work can use non-invertible embedding techniques to prevent ambiguity attack. Digital watermarking can be fragile, which does not resist modifications of the multimedia, or it can be robust, which is secure against common modifications [43]. Fragile watermarks can be used for multimedia authentication whereas robust watermark can be used in multimedia leakage. Semi-fragile watermarks can be used for both media authentication and recovery. An image authentication scheme that uses relative similarity between neighboring image blocks is introduced in [16]. A fragile watermarking technique to increase security by embedding watermark into the image frequency domain by using genetic algorithms is described in [74]. A method to vary quantization factor in DCT domain to weight robustness of the watermark versus the watermark’s image quality is presented in [47]. A public and private watermark extraction methods are described in [1] by using asymmetric and symmetric techniques, respectively. A watermark image, parts of which are embedded into different video scenes is described in [14]. In addition, the error correcting code is embedded in the audio channel. A multimedia gateway security protocol is introduced in [53]. The protocol provides authentication, a watermark detection at a server or gateway, and the system response to security breach. Digital watermarking parameters and security measures are described in [9]. The embedding algorithms and procedures are introduced in [89]. Discussions to improve the performance of watermarking algorithms are conducted in [43]. A visible watermarking technique by using a contrast-sensitive function is introduced in [34]. An algorithm to embed watermark coefficients into the image blocks is presented in [67]. This nonuniform embedding allows for robustness against cropping. A method to embed a watermark using neural networks is presented in [97].

5.

Steganography

Steganography is used to write hidden messages inside the image in such a way that nobody except for the intended recipient knows about the message. The hidden message appears as something different from the image in which it is embedded, for example, it can be a picture or text. A steganographic message can be encrypted in many different ways, and only the recipient who knows the method used can decrypt the message. In computer communication networks, the steganographic coding occurs at the transport layer. Steganography allows for hiding files or encrypted messages in several file types, for example, JPEG, PNG, BMP, HTML (hypertext markup language), and WAV


29

(waveform). Steganalysis is used to detect modified files by comparing their contents. Many files accessible through the Internet-use GIF image. A method to detect secret messages in multimedia GIF format image by using statistical steganalysis is presented in [40]. In files using lossless compression, for example, GIF and BMP files, a simple data hiding within the image can employ LSB (least significant bit) insertion. Changing the LSB in the binary image according to a predefined pattern allows for inserting hidden data. Steganography methods can use other patterns to include or to extract a hidden message. File transformation can be done by using DCT coefficients in JPEG images to hide the information in lossy compression. Steganography is employed to detect hidden communication channels used by adversaries over the Internet. Intrusion detection systems for VoIP (voice over Internet protocol) applications are described in [18, 31, 41].

6.

Computer Forensics

Computer forensics is a technological inspection of a computer, its files, and the devices for its present and past content that may be used as evidence of a crime or other computer use that is the subject of an inspection. This computer inspection must be both technical and legal to meet the standards of evidence that are admissible in a court of law. The examination of a computer includes its hardware, for instance, memory, disk, and other I/O (input/output) devices, as well as the operating systems actions, for example, system calls, including system traps, and finally the software that was executed on the computer. In addition, the user programs and electronic messages (E-mails) need to be reviewed. The information recovered to show the crime depends on whether the computer was a target of a crime or was a computer involved to commit a crime. Forensics investigation includes computer break-ins by an unauthorized user, disallowed data duplication, theft, espionage, inappropriate Internet use or abuse, etc. The information recovered often resides on the disk drives and other storage devices that retain traces of unauthorized access. Multimedia forensics uses authentication and identification to recognize the ownership and possible media manipulation. Multimedia forensics can be applied to video and audio, can be used for facial recognition, speaker identification, handwriting comparison, and image authentication. DNA profiling is used in forensic analysis and investigations. Image forensics analyzes the condition of an image to detect forgery or to identify the source of the image. Image forgery may occur

A. HAC´

30

through photomontage, retouching, or removing some objects. The image source can be identified as the camera, computer graphics, printer, scanner, etc. The image scene can be identified as 2D or 3D (3-dimensional). The image forensics searches image authenticity by defining characteristics of the imaging device and the scene of the image. The device characteristics include specific effects of a particular camera, for instance, optical low-pass, color filter array interpolation, and lens distortion. The scene characteristics include lighting and shadows on the image, and the reflectance of the objects present in the image. Digital fingerprinting embeds a unique identifier into each copy of the multimedia work. In a collusion attack, a group of users generates a new version of multimedia work by combining these users’ copies of the same content, which originally had different fingerprints. These fingerprints are attenuated or removed by a collusion attack. A theoretical framework for the linear collusion attack and analysis is presented in [78]. A multiple-frame linear collusion resulting in an approximation of the original watermark is created by scaling and adding watermarked video frames. Collusionresistant watermarks are created by changing watermarking key every number of frames that ensures certain frames to have pair-wise correlations. The purpose of fingerprinting multimedia systems is to prevent collusion attacks and other single-copy attacks. Secure video streaming of fingerprinted applications over the networks to reduce bandwidth for large number of participants is presented in [100]. A fingerprinting image makes each multimedia application slightly different and prevents traditional multicast technology, for instance, one-to-many or many-to-many transfer, to be implemented directly. Spread spectrum embeddingbased fingerprinting is a data hiding method through coefficient embedding to protect the multimedia image against collusion attacks. An analysis of behavior pattern of attackers during multiuser collusion is discussed in [98]. Timing of processing a fingerprinted copy by a single colluder impacts collusion detection. The quality of the fingerprinted copy, particularly a higher resolution, increases likelihood of collusion attack [99].

7.

Sensor Networks

Wireless sensor networks use small devices equipped with sensors, microprocessor, and wireless communication interfaces [63, 64, 92]. Wireless sensor nodes are deployed in areas and environments where they may be hard to access, yet these nodes need to provide information about measurements of temperature, humidity,


31

biological agents, seismic activity, and sometimes take pictures and perform many other activities. Macrosensor nodes usually provide accurate information about measured activity. The accuracy of information provided by individual microsensor nodes is lower, yet a network of hundreds or thousands of nodes deployed in an area enables to achieve fault tolerant high quality measurements. Wireless sensor nodes are designed by using MEMS (microelectromechanical systems) technology and its associated interfaces, signal processing, and RF (radio frequency) circuitry. Communication occurs within a wireless microsensor network, which aggregates the data to provide information about the observed environment. Low energy dissipation is particularly important for wireless microsensor nodes, which are deployed in hundreds or thousands, and are often hard to read in inhospitable terrain. A power-aware system employs a network design whose energy consumption adapts to constraints and changes in the environment [66, 75, 76]. These power-aware design methods offer scalable energy savings in wireless microsensor environment [3]. There is a trade off between battery lifetime and quality performance of data collection and transmission [2]. Activity in the observed environment may lead to significant measurement diversity in the sensor node microprocessor. Node functionality may also vary, for instance, a sensor networking protocol may request the node to act as a data gatherer, aggregator, relay, or any combination of these. This way, the microprocessor can adjust the energy consumption depending on the activity in the measured environment. Several devices have been built to perform sensor node functions. A software and hardware framework includes a microprocessor, low-power radio, battery, and sensors [11, 65, 87]. Data aggregation and network protocols are processed by using a micro-operating system. Data aggregation is used as a data reduction tool [44]. Aggregates summarize current sensor values in sensor network. Computing aggregates in sensor network preserves network performance and saves energy by reducing the amount of data routed through the network [17]. The computation of aggregates can be optimized by using SQL (Structured Query Language). The data are extracted from the sensor network by using declarative queries. Examples of database aggregates (COUNT, MIN, MAX, SUM, and AVERAGE) can be implemented in a sensor network. Aggregation in SQL-based database systems is defined by an aggregate function and a grouping predicate. The aggregate function specifies how to compute an aggregate [50]. Aggregation can be implemented in a centralized network by using a server-based approach where all sensor readings are sent to the host PC (personal computer), which computes the aggregates. A distributed system approach allows in-network computing of aggregates, thus decreasing the number of forwarded readings that are routed through the network to the host PC.

32

A. HAC´

The small battery-powered sensor devices have limited computational and communication resources [30]. This makes it impractical or even impossible to use secure algorithms designed for powerful workstations. A sensor node memory is not capable of holding the variables required in asymmetric cryptographic algorithms, and perform operations by using these variables. The sensor nodes communicate by using RF, thus trust assumptions and minimal use of energy are important for network security. The sensor network communication patterns include sensor readings, which involve node to base station communication, specific requests from the base station to the node, and routing or queries from the base station to all sensor nodes. Because of sensor nodes limitations, the sensor nodes are not trusted. The base stations on the other hand, belong to the TCPA trusted computing base. The senor nodes trust the base station and are given a master key which is shared with the base station. The possible threats to network communication security are an insertion of malicious code, an interception of the messages, and injecting false messages. Wireless technologies enabling communications with sensor nodes include Bluetooth and LR-WPAN (Low-Rate Wireless Personal Area Network) [27]. Bluetooth enables seamless voice and data communication via short-range radio links. Bluetooth provides a nominal data rate of 1 Mbps for a piconet, which consists of one master and up to seven slaves. The master defines and synchronizes the frequency hop pattern in its piconet. Bluetooth operates in the 2.4 GHz ISM (Industrial, Scientific, and Medical) band. Low-Rate Wireless Personal Area Network (LR-WPAN) is defined by the IEEE 802.15.4 standard. This network has ultralow complexity, cost, and power for low data-rate sensor nodes [13]. The IEEE 802.15.4 offers two physical layer options: the 2.4 GHz physical layer and the 868/915 MHz physical layer. The 2.4 GHz physical layer specifies operation in the 2.4 GHz ISM band. The 868/915 MHz physical layer specifies operation in the 868 MHz band in Europe and in 915 MHz band in the United States. The main features of the IEEE 802.15.4 standard are network flexibility, low cost, and low-power consumption. This standard is suitable for many applications in the home requiring low-data-rate communications in an ad hoc self-organizing network. The major resource constraint in sensor networks is power, due to the limited battery life of sensor devices [30, 32]. Data-centric methodologies can be used to solve this problem efficiently. Data-centric storage (DCS) is used as a datadissemination paradigm for sensor networks. In DCS, data is stored, according to event type, at corresponding sensornet nodes. All data of a certain event type is stored at the same node. A significant energy saving benefit of DCS is that queries for data of a certain type can be sent directly to the node storing data of that type. Resilient Data-Centric Storage (R-DCS) is a method to achieve scalability and


33

resilience by replicating data at strategic locations in the sensor network [21]. This scheme leads to significant energy savings in networks and performs well with increasing node density and query rate. Sensor network management protocol has to support control of individual nodes, network configuration updates, location information data exchange, network clustering, and data aggregation rules. Sensor network gateway has to provide tools and functions for presentation of network topology, services, and characteristics to the users and to connect the network to other networks and users. Sensor networks are vulnerable to security attacks due to the wireless nature of the transmission medium. In wireless sensor networks, the nodes are often placed in a hostile or dangerous environment where they are not physically protected. The standard approach to maintain data secrecy is to encrypt the data with a secret key that is known only to the intended recipients. The secure channels can be set up between sensor nodes and base stations based on their communications patters.

8.

Security Protocols for Wireless Sensor Networks

Sensor networks become more commonly used in many fields and applications, causing the security issues to become more important. Security in sensor networks needs to be optimized for resource-constrained environments and wireless communication. SPINS (Security Protocol for Sensor Networks) [61] has two secure building blocks: SNEP (Secure Network Encryption Protocol) and mTESLA (the micro version of the Timed, Efficient, Streaming, Loss-tolerant Authentication Protocol). SNEP provides the following security primitives: data confidentiality, two-party data authentication, and data freshness. Efficient broadcast authentication is an important mechanism for sensor networks. mTESLA is a protocol which provides authenticated broadcast for resource-constrained environments making it suitable for sensor nodes. An authenticated routing protocol uses SPINS building blocks. Communications of sensor nodes uses RF that consumes node energy. There is a trade off between computation and communication in energy consumption. Devices usually employ a small battery as the energy source. The other sources of energy are also limited. Communication over radio is the highest energy-consuming function performed by the devices. This imposes limits on security used by these devices. The lifetime of security keys is limited by the power supply of the microprocessor performing security functions. On the other hand, the base stations have large energy supplies often wired and connected to the communications network.

A. HAC´

34

Wireless sensor network connects to a base station, to which information is routed from the sensor nodes. The base station has significant battery power, large memory to store cryptographic keys, and communicates with other wired and wireless networks. The communication between wireless sensor nodes and base station includes sensor readings from sensor node to the base station, requests from base station to sensor node, and routing beacons and queries from base station to sensor nodes. Several encryption algorithms are evaluated in [49]. SEAL (software-optimized encryption algorithm) is stream cipher, making it much faster than block cipher RC5, but having longer initialization phase. SEAL is a very safe algorithm using 160-bit key encryption [49]. RC4 is a fast stream cipher algorithm with key size of up to 2,048 bits. This algorithm can be used with a new key selected for each message. RC5 is a fast symmetric block cipher algorithm [68, 69]. Tiny encryption algorithm (TEA) [55] is a block cipher operating on 64-bit blocks and using 128-bit key. TEA is fast and simple, but its security weakness is having equivalent keys, which reduces the effective key size to 126 bits. There are extensions of TEA [56], which correct some of the weaknesses of original TEA. XTEA (eXtended TEA) has a more complex key schedule, and XXTEA (corrected block TEA) operates on variable length blocks that are 32 bits. A fast software encryption is described in [96]. The comparison of encryption algorithms in [49] suggests TEA as the most suitable for sensor networks with limited memory and high speed requirements.

9.

Communication Security in Sensor Networks

A possible threat to network communication security is an insertion of malicious code, which the network could spread to all nodes, potentially destroying the whole network, or even worse, taking over the network on behalf of an adversary. The sensor nodes location needs to be hidden from potential attackers. In addition, the application specific content of messages needs to be protected. An adversary can inject false messages that provide incorrect information. The security overhead in wireless sensor network should be related to sensitivity of the encrypted information. Three levels of information security rank the most sensitive the mobile code, then the sensor location information in messages, and finally the application specific information [77]. The strength of the encryption for each of security rank corresponds to the sensitivity of the encrypted information. The encryption applied at the top rank is stronger than the encryption applied at next rank, and the weakest encryption is at the lowest security rank. RC6 (symmetric


35

block cipher) meets the requirements of AES, and uses an adjustable parameter, which is the number of rounds that affects its strength. The overhead for the RC6 encryption algorithm increases with the strength of the encryption. A framework for a sensor network to protect data and communicate with the operating system is introduced in [82]. The proposed framework detects attacks on the sensor data and software. A model that captures system and user behavior is developed and introduced as a control behavioral model (CBM). An application of group key management scheme to sensor networks by using a clustering approach is described in [94].

10.

Sensor Software Design

Embedded systems require hardware and software codesign tools and frameworks. A complete design environment for embedded systems should include dynamically reconfigurable hardware components [5]. Designing configurable hardware and software systems requires specification, initial profiling, and the final implementation of the system’s software components. Designing an embedded system’s digital hardware requires a hardware description language and synthesis tools, which are used for an abstract circuit design. In order to reduce development time and effort, embedded systems’ designers employ abstract specification, and apply the reuse of hardware and software components. In embedded system design, a major share of functionality is implemented in software. This allows for faster implementation, more flexibility, easier upgradability, and customization with additional features [19, 20]. Networked embedded systems are equipped with communication capabilities and can be controlled over networks. Networked embedded system design includes Internet mobility, network programming, security, and synchronization [79, 81]. Programmable architecture is an efficient way of implementing the multiple-application support. Several system-level design languages and codesign frameworks have been proposed. Designing run-time reconfigurable hardware and software systems requires a complete design environment for embedded systems including dynamically reconfigurable hardware components.

11.

Trusted Software

Software is an important part of multimedia systems and applications. Reliable and secure software design is often based on design diversity.

A. HAC´

36

Software security is crucial to maintain run-time environment for multimedia applications. Intrusion detection is a method to verify that the running software is not prone to a particular attack. Intrusion prevention makes an adversary to solve a computationally difficult (preferably intractable) task to create a binary program that can be executed. SPEF (Secure Program Execution Framework) [39] is an intrusion prevention system that installs software binary programs by encoding constraints using secure one-way hash function, where the secret key is hidden in the processor hardware and can only be accessed by the software installer.

12.

Hardware Power-Aware Sensor Security

Energy consumption is an important challenge to networks of distributed microsensors [85, 86]. Microsensors are used for data gathering, they are small, and the life of microsensor nodes is an important factor. Nodes’ lifetimes [6] depend on the algorithms and protocols that provide the option of trading quality for energy savings. Dynamic voltage scaling on the sensor node’s processor enables energy savings from these scalable algorithms [12, 52, 58]. Energy consumption depends on the available resources and communication between sensor nodes [23]. The architecture for a power-aware microsensor node employs collaboration between software and hardware [15]. The node’s processor is capable of scaling energy consumption gracefully with computational workload. This scalability allows for energy-agile algorithms of scalable computational complexity. Energy and quality are important characteristics of DSP (Digital Signal Processing) algorithms. Power awareness becomes increasingly important in VLSI (Very Large Scale Integration) systems to scale power consumption in response to changing operating conditions [7, 88]. These changes are caused by the changes in inputs, the output quality, or the environmental conditions. Low-power system design allows the system’s energy consumption to scale with changing conditions and quality requirements [26].

13.

Trusted Hardware

Hardware is part of multimedia systems and applications. Reliable hardware design is based on duplication. TCPA (trusted computing platforms) use hardware processor architecture [48] that provides copy protection and tamper-resistance functions. In this hardware, the processor is the trusted part of the architecture. Other architecture parts are not


37

trusted, for example, main memory. The trustworthiness of the management system for the applications that do not trust that system creates a specialized set of functions to maintain security between untrusted manager and trusted hardware processor.

14.

Sensor Networks and RFID Security

RFID is a compact wireless technology using devices called RFID tags or transponders [72]. Those RFID tags are attached to a product, an animal, or a person in a form of an integrated circuit communicating via radio frequency signal with the receiving antenna. A chipless RFID allows for discrete identification of tags without an integrated circuit, a decrease in cost of printed tags. The RFID tags are used to store and retrieve data about the products, animals, or people; these tags are attached to or printed onto. Applications of different RFID tags in telemedicine and in banking are discussed in [90]. An architecture of RFID network is presented in [101]. The RFID middleware is employed to provide resilience for diversified RFIDs and increase the architecture scalability and security. An analysis of middleware quality is introduced in [57]. The concept of mobile RFID is introduced in [45] along with related problems of privacy threats. A multi-domain RFID system security is described in [38].

15.

Conclusion

We have discussed several different aspects and requirements for multimedia and sensor security. These aspects include communication security to transfer the information over the communication medium, as well as access security to identify the objects that were not subject to tampering. The method to protect the information depends on the application, and on the type of device, on which the application is executed. Multimedia applications rely on security in real time, compression for transmission, and on digital watermarking and steganography for access. Sensor security explores limited device size, power, memory, and processing capability to maintain secure access and communication. References [1] Ahmed F., and My S., December 2005. A hybrid-watermarking scheme for asymmetric and symmetric watermark extraction. In Proceedings of the IEEE 9th International Multitopic Conference, pp. 1–6.

38

A. HAC´

[2] Amirthajah R., Xanthopoulos T., and Chandrakasan A. P., 1999. Power scalable processing using distributed arithmetic. In Proceedings of the International Symposium on Low Power Electronics and Design, pp. 170–175. [3] Asada G., et al., September 1998. Wireless integrated network sensors: Low power systems on a chip. In Proceedings of the ESSCIRC. [4] Bellovin S., and Merrit M., 1993. Augmented encrypted key exchange: A password-based protocol secure against dictionary attacks and password file compromise. In First ACM Conference on Computer and Communications Security CCS-1, pp. 244–250. [5] Benini L., and Micheli G. D., 1997. Dynamic Power Management: Design Techniques and CAD Tools. Kluwer, Norwell, MA. [6] Bhardwaj M., Garnett T., and Chandrakasan A., June 2001. Upper bounds on the lifetime of sensor networks. In Proceedings of the ICC, vol. 3, pp. 785–790. [7] Bhardwaj M., Min R., and Chandrakasan A., December 2001. Quantifying and enhancing powerawareness of VLSI systems. IEEE Transaction on Very Large Scale Integration (VLSI) Systems, 9(6): 757–772. [8] Blom R., Carrara E., Lindholm F., Norrman K., and Naslund M., September 9–11, 2002. Conversational IP multimedia security. In Proceedings of the IEEE 4th International Workshop on Mobile and Wireless Communications Network, pp. 147–151. [9] Bojkovic Z., and Milovanovic D., October 1–3, 2003. Multimedia contents security: Watermarking diversity and secure protocols. In Proceedings of the 6th International Conference on Telecommunications in Modern Satellite, Cable and Broadcasting Service, vol. 1, pp. 377–383. [10] Borriello G., and Want R., May 2000. Embedding the internet: Embedded computation meets the world wide web. Communications of the ACM, 43(5): 59–66. [11] Bult K., et al., 1996. Low power systems for wireless microsystems. In Proceedings of the ISLPED, pp. 17–21. [12] Burd T., Pering T., Stratakos A., and Brodersen R., 2000. A dynamic voltage scaled microprocessor system. In Proceedings of the ISSCC, pp. 294–295. [13] Callaway E., Gorday P., Hester L., Gutierrez J. A., Naeve M., Heile B., and Bahl V., August 2002. Home networking with IEEE 802.15.4: A developing standard for low-rate wireless personal area networks. IEEE Communications Magazine, 40(8): 70–77. [14] Chan P. W., Lyu M. R., and Chin R. T., December 2005. A novel scheme for hybrid digital video watermarking: Approach, evaluation and experimentation. IEEE Transactions on Circuits and Systems for Video Technology, 15(12): 1638–1649. [15] Chandrakasan A. P., et al., May 1999. Design considerations for distributed microsensor systems. In Proceedings of the Custom Integrated Circuits Conference, pp. 279–286. San Deigo, CA. [16] Chotikakamthorn N., and Sangiamkun W., August 19–22, 2001. Digital watermarking technique for image authentication by neighboring block similarity measure. In Proceedings of the IEEE Region 10th International Conference on Electrical and Electronic Technology, vol. 2, pp. 743–747. [17] Czerwinski S. E., Zhao B. Y., Hodes T. D., Joseph A. D., and Katz R. H., August 1999. An architecture for a secure service discovery service. In Fifth Annual ACM/IEEE International Conference on Mobile Computing and Networking, pp. 24–35. Seattle, WA. [18] Dittmann J., and Hesse D., September 29–October 1, 2004. Network based intrusion detection to detect steganographic communication channels: On the example of audio data. In Proceedings of the IEEE 6th Workshop on Multimedia Signal Processing, pp. 343–346. [19] Fleischmann J., Buchenrieder K., and Kress R., 1998. A hardware/software prototyping environment for dynamically reconfigurable embedded systems. In Proceedings of the International IEEE Workshop on Hardware/Software Codesign (CODES/CASHE’98), pp. 105–109.


39

[20] Fleischmann J., and Buchenrieder K., 1999. Prototyping networked embedded systems. Computer, 32(2): 116–119. [21] Ghose A., Grossklags J., and Chuang J., 2003. Resilient data-centric storage in wireless Ad-hoc sensor networks. In Proceedings of the 4th International Conference on Mobile Data Management (MDM 2003), Melbourne, Australia, January 21–24, 2003, pp. 45–62. Lecture Notes in Computer Science 2574. Springer. [22] Gong L., and Shacham N., 1995. Multicast security and its extension to a mobile environment. Wireless Networks, 1(3): 281–295. [23] Goodman J., Dancy A., and Chandrakasan A., November 1998. An energy/security scalable encryption processor using an embedded variable voltage DC/DC converter. Journal of Solid State Circuits, 33(11): 1799–1809. [24] Grangetto M., Grosso A., and Magli E., September 29–October 1, 2004. Selective encryption of JPEG 2000 images by means of randomized arithmetic coding. In Proceedings of the IEEE 6th Workshop on Multimedia Signal Processing, pp. 347–350. [25] Grangetto M., Magli E., and Olmo G., October 2006. Multimedia selective encryption by means of randomized arithmetic coding. IEEE Transactions on Multimedia, 8(5): 905–917. [26] Gutnik V., and Chandrakasan A. P., December 1997. Embedded power supply for low-power DSP. IEEE Transactions on Very Large Scale Integration (VLSI) Systems, 5(4): 425–435. [27] Haartsen J., Naghshineh M., Inouye J., Joeressen O. J., and Allen W., October 1998. Bluetooth: Vision, goals, and architecture. Mobile Computing and Communications Review, 2(4): 38–45. [28] Hac´ A., June 13–16, 2005. Embedded systems and sensors in wireless networks. In Proceedings of the International IEEE Conference on Wireless Networks, Communications, and Mobile Computing WirelessCom, pp. 330–335. Maui, Hawaii. [29] Hac´ A., and Lu D., 1997. Architecture, design, and implementation of a multimedia conference system. International Journal of Network Management, 7(2): 64–83. [30] Heinzelman W., Chandrakasan A., and Balakrishnan H., January 2000. Energy-efficient communication protocol for wireless microsensor networks. In Proceedings of the 33rd Hawaii International Conference on System Sciences (HICSS), pp. 3005–3014. [31] Hesse D., Dittmann J., and Lang A., 2004. Network based intrusion detection to detect steganographic communication channels – on the example of images. In Proceedings of the 30th Euromicro Conference, pp. 453–456. [32] Hill J., Szewczyk R., Woo A., Hollar S., Culler D., and Pister K., November 2000. System architecture directions for networked sensors. In Proceedings of the 9th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, pp. 93–104. Cambridge, Massachusetts. [33] Hsu C., May 2002. WaveNet processing brassboards for live video via radio. In Proceedings of the IEEE International Joint Conference on Neural Networks, vol. 3, pp. 2210–2213. [34] Huang B.-B., and Tang S.-X., April–June 2006. A contrast-sensitive visible watermarking scheme. IEEE Multimedia, 13(2): 60–66. [35] Kalavade A., and Moghe P., 1998. A tool for performance estimation of networked embedded endsystems. In Proceedings of the IEEE Design Automation Conference (DAC). [36] Kalavade A., and Subrahmanyam P. A., 1997. Hardware/software partitioning for multi-function systems. In Proceedings of the IEEE International Conference on Computer Aided Design, pp. 516–521. [37] Kiaei M. S., Ghaemmaghami S., and Khazaei S., February 19–25, 2006. Efficient fully format compliant selective scrambling methods for compressed video streams. In Proceedings of the International Conference on Internet and Web Applications and Services/Advanced International Conference on Telecommunications, pp. 42–49.

40

A. HAC´

[38] Kim D. S., Shin T.-H., and Park J. S., April 10–13, 2007. A Security framework in RFID multi-domain system. In Proceedings of the Second IEEE International Conference on Availability, Reliability and Security, pp. 1227–1234. [39] Kirovski D., Drinic M., and Potkonjak M., 2002. Enabling trusted software integrity. In Proceedings of the 10th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, pp. 108–120. ACM Press, San Jose, CA. [40] Kong X., Wang Z., and You X., December 6–9, 2005. Steganalysis of palette images: Attack optimal parity assignment algorithm. In Proceedings of the Fifth IEEE International Conference Information, Communications and Signal Processing, pp. 860–864. [41] Kratzer C., Dittmann J., Vogel T., and Hillert R., May 21–24, 2006. Design and evaluation of steganography for voice-over-IP. In Proceedings of the IEEE International Symposium on Circuits and Systems, p. 4. [42] Kundur D., Zourntos T., and Mathai N. J., November 2004. Lightweight security principles for distributed multimedia based sensor networks. In Proceedings of the Thirty-Eighth Asilomar Conference on Signals, Systems and Computers, vol. 1, pp. 368–372. [43] Kundur D., October–December 2001. Watermarking with diversity: Insights and implications. IEEE Multimedia, 8(4): 46–52. [44] Larson P.-A., 2002. Data reduction by partial preaggregation. In Proceedings of the International Conference on Data Engineering, pp. 706–715. [45] Lee H., and Kim J., April 20–22, 2006. Privacy threats and issues in mobile RFID. In Proceedings of the IEEE First International Conference on Availability, Reliability and Security, p. 5. [46] Li H., and Dhawan A., June 2004. Agent based multiple level dynamic multimedia security system. In Proceedings of the Fifth Annual IEEE SMC Information Assurance Workshop, pp. 291–297. [47] Li X., and Xue X., May 2–5, 2004. A novel blind watermarking based on lattice vector quantization. In Proceedings of the Canadian Conference on Electrical and Computer Engineering, vol. 3, pp. 1823–1826. [48] Lie D., Thekkath C. A., and Horowitz M., October 2003. Implementing an untrusted operating system on trusted hardware. In Proceedings of the 19th ACM Symposium on Operating Systems Principles, pp. 178–192. ACM Press. [49] Luo X., Zheng K., Pan Y., and Wu Z., October 2004. Encryption algorithms comparisons for wireless networked sensors. In Proceedings of the International Conference on Systems, Man and Cybernetics, vol. 2, pp. 1142–1146. [50] Madden S., Szewczyk R., Franklin M. J., and Culler D., June 2002. Supporting aggregate queries over Ad-Hoc wireless sensor networks. In Proceedings of the Fourth IEEE Workshop on Mobile Computing and Systems Applications, pp. 49–58. [51] Menezes A. J., van Oorschot P., and Vanstone S., 1997. Handbook of Applied Cryptography. CRC Press. [52] Min R., Furrer T., and Chandrakasan A., April 2000. Dynamic voltage scaling techniques for distributed microsensor networks. In Proceedings of the IEEE Computer Society Annual Workshop on VLSI (WVLSI 2000), pp. 43–46. [53] Narang S., Grover P. S., and Koushik S., July 30–August 2, 2000. Multimedia security gateway protocol to achieve anonymity in delivering multimedia data using watermarking. In Proceedings of the IEEE International Conference on Multimedia and Expo, vol. 1, pp. 529–532. [54] Nawab S. H., et al., January 1997. Approximate signal processing. Journal of VLSI Signal Processing Systems for Signal, Image, and Video Technology, 15(1/2): 177–200. [55] Needham R., and Wheeler D., 1994. TEA, a tiny encryption algorithm. In Fast Software Encryption: Second International Workshop, vol. 1008, pp. 14–16. Springer LNCS.


41

[56] Needham R., and Wheeler D., 1996. TEA Extension. Computer Laboratory Cambridge University. [57] Oh G., Kim D., Kim S., and Rhew S., November 2006. A quality evaluation technique of RFID middleware in ubiquitous computing. In Proceedings of the IEEE International Conference on Hybrid Information Technology, vol. 2, pp. 730–735. [58] Pering T., Burd T., and Broderson R., 1998. The simulation and evaluation of dynamic voltage scaling algorithms. In Proceedings of the International Symposium on Low Power Electronics and Design, pp. 76–81. [59] Perrig A., Canetti R., Song D., and Tygar J. D., February 2001. Efficient and secure source authentication for multicast. In Proceedings of the Network and Distributed System Security Symposium, NDSS ‘01. [60] Perrig A., Canetti R., Tygar J. D., and Song D., May 2000. Efficient authentication and signing of multicast streams over lossy channels. In Proceedings of the IEEE Symposium on Security and Privacy. [61] Perrig A., Szewczyk R., Wen V., Culler D., and Tygar J. D., June 2001. SPINS: Security protocols for sensor networks. In Proceedings of the ACM/IEEE International Conference on Mobile Computing and Networking (MobiCom 2001), pp. 189–199. [62] Pfleeger C. P., 1997. Security in Computing. Prentice Hall. [63] Pottie G., 1998. Wireless sensor networks. In Proceedings of the Information Theory Workshop, pp. 139–140. [64] Pottie G. J., and Kaiser W. J., May 2000. Embedding the internet: Wireless integrated network sensors. Communications of the ACM, 43(5): 51–58. [65] Rabaey J. M., Ammer M. J., da Silva J. L., Patel D., and Roundy S., July 2000. PicoRadio supports ad hoc ultra-low power wireless networking. IEEE Computer, 42–48. [66] Raghunathan V., Schurgers C., Park S., and Srivastava M. B., March 2002. Energy-aware wireless microsensor networks. IEEE Signal Processing Magazine, 19(2): 40–50. [67] Retsas I., Pieper R., and Cristi R., March 18–19, 2002. Watermark recovery with a DCT based scheme employing nonuniform embedding. In Proceedings of the 2002 IEEE Thirty-Fourth Southeastern Symposium on System Theory, pp. 157–161. [68] Rivest R. L., 1995. The RC5 encryption algorithm. In Proceedings of the First Workshop on Fast Software Encryption, pp. 86–96. [69] Rivest R. L., April 1992. The MD5 message-digest algorithm. Internet Request for Comments, RFC 1321. [70] Rivest R. L., Shamir A., and Adleman L. M., 1978. A method for obtaining digital signatures and public-keycrypto systems. Communications of the ACM, 21(2): 120–126. [71] Rohatgi P., November 1999. A compact and fast hybrid signature scheme for multicast packet authentication. In Sixth ACM Conference on Computer and Communications Security. [72] Roussos G., 2008. Computing with RFID: Drivers, technology and implications. In M. Zelkowitz, editor, Advances in Computers Elsevier. [73] Shawbaki W., February 19–25, 2006. Multimedia security in passive optical networks via wavelength hopping and codes cycling technique. In Proceedings of the International Conference on Internet and Web Applications and Services/Advanced International Conference on Telecommunications, pp. 51–56. [74] Shih F. Y., and Wu Y.-T., June 27–30, 2004. A novel fragile watermarking technique. In Proceedings of the International Conference on Multimedia and Expo, vol. 2, pp. 875–878. [75] Sinha A., and Chandrakasan A., January 2001. Operating system and algorithmic techniques for energy scalable wireless sensor networks. In Proceedings of the Second International Conference on Mobile Data Management (MDM 2001), Hong-Kong, Lecture Notes in Computer Science, vol. 1987, Springer Verlag.

42

A. HAC´

[76] Sinha A., and Chandrakasan A., Mar/April 2001. Dynamic power management in wireless sensor networks. IEEE Design and Test of Computers, 18(2): 62–74. [77] Slijepcevic S., Potkonjak M., Tsiatsis V., Zimbeck S., and Srivastava M. B., 2002. On communication security in wireless ad-hoc sensor networks. In Proceedings of the Eleventh IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises (WET ICE 2002), pp. 139–144. [78] Su K., Kundur D., and Hatzinakos D., February 2005. Statistical invisibility for collusion-resistant digital video watermarking. IEEE Transactions on Multimedia, 7(1): 43–51. [79] Sukhatme G. S., and Mataric M. J., May 2000. Embedding the internet: Embedding robots into the internet. Communications of the ACM, 43(5): 67–73. [80] Swaminathan A., Mao Y., and Wu M., June 2006. Robust and secure image hashing. IEEE Transactions on Information Forensics and Security, 1(2): 215–230. [81] Tennenhouse D., May 2000. Embedding the internet: Proactive computing. Communnications of the ACM, 43(5): 43–50. [82] Uppuluri P., and Basu S., LASE: Layered approach for sensor security and efficiency. In Proceedings of the International IEEE Conference on Parallel Processing Workshops, pp. 346–352. [83] U. S. National Institute of Standards and Technology (NIST) January 1999. Data encryption standard (DES), draft federal information processing standards publication 46–3 (FIPS PUB 46–3). [84] Villan R., Voloshynovskiy S., Koval O., and Pun T., December 2006. Multilevel 2-D Bar Codes: toward high-capacity storage modules for multimedia security and management. IEEE Transactions on Information Forensics and Security, 1(4): 405–420. [85] Wang A., Cho S.-H., Sodini C., and Chandrakasan A., August 2001. Energy efficient modulation and MAC for asymmetric RF microsensor systems. In Proceedings of the ISLPED, pp. 106–111. [86] Wang A., Heinzelman W., and Chandrakasan A., October 1999. Energy-scalable protocols for battery-operated microsensor networks. In Proceedings of the SiPS, pp. 483–492. [87] Wei G., and Horowitz M., A low power switching supply for self-clocked systems. In Proceedings of the ISLPED, pp. 313–317. [88] Weiser M., Welch B., Demers A., and Shenker S., 1998. Scheduling for reduced CPU energy. In A. Chandrakasan and R. Brodersen, editors, Low Power CMOS Design, pp. 177–187. [89] Wu Y.-T., Shih F. Y., and Wu Y.-T., May 2006. A robust high-capacity watermarking algorithm. In Proceedings of the IEEE International Conference on Electro/information Technology, pp. 442–447. [90] Xiao Y., Shen X., Sun B., and Cai L., April 2006. Security and privacy in RFID and applications in telemedicine. IEEE Communications Magazine, 44(4): 64–72. [91] Xie D., and Kuo C.-C. J., May 23–26, 2004. Enhanced multiple huffman table (MHT) encryption scheme using key hopping. In Proceedings of the International Symposium on Circuits and Systems, vol. 5, pp. V-568–V-571. [92] Yao K., et al., October 1998. Blind beam forming on a randomly distributed sensor array system. IEEE Journal on Selected Topics in Communications, 16(8): 1555–1567. [93] Yongliang L., Gao W., and Liu S., August 29–September 1, 2004. Multimedia security in the distributed environment. In Proceedings of the Joint Conference of the 10th Asia-Pacific Conference on Communications and the 5th International Symposium on Multi-Dimensional Mobile Communications, vol. 2, pp. 639–642. [94] Younis M. F., Ghumman K., and Eltoweissy M., August 2006. Location-aware combinatorial key management scheme for clustered sensor networks. IEEE Transactions on Parallel and Distributed Systems, 17(8): 865–882.


43

[95] Yuan C., Zhu B. B., Wang Y., Li S., and Zhong Y., May 25–28, 2003. Efficient and fully scalable encryption for MPEG-4 FGS. In Proceedings of the International Symposium on Circuits and Systems, vol. 2, pp. II-620–II-623. [96] Yuval G., 1997. Reinventing the travois: Encryption/MAC in 30 ROM bytes. In Proceedings of the Fourth Workshop on Fast Software Encryption. [97] Zhang J., Wang N.-C., and Feng Xiong, November 4–5, 2002. A novel watermarking for images using neural networks. In Proceedings of the International Conference on Machine Learning and Cybernetics, vol. 3, pp. 1405–1408. [98] Zhao H. V., and Liu K. J. R., December 2006. Traitor-within-traitor behavior forensics: strategy and risk minimization. IEEE Transactions on Information Forensics and Security, 1(4): 440–456. [99] Zhao H. V., and Liu K. J. R., September 2006. Behavior forensics for scalable multiuser collusion: Fairness versus effectiveness. IEEE Transactions on Information Forensics and Security, 1(3): 311–329. [100] Zhao H. V., and Liu K. J. R., January 2006. Fingerprint multicast in secure video streaming. IEEE Transactions on Image Processing, 15(1): 12–29. [101] Zhao Y. Z., and Gan O. P., August 2006. Distributed design of RFID network for large-scale RFID deployment. In Proceedings of the IEEE International Conference on Industrial Informatics, pp. 44–49. [102] Zhou J., Liang Z., Chen Y., and Au O. C., March 2007. Security analysis of multimedia encryption schemes based on multiple huffman table. IEEE Signal Processing Letters, 14(3): 201–204.

Email Spam Filtering ENRIQUE PUERTAS SANZ Universidad Europea de Madrid Villaviciosa de Odoń, 28670 Madrid, Spain

´ MEZ HIDALGO JOSE´ MARIÁ GO Optenet Las Rozas 28230 Madrid, Spain

JOSE´ CARLOS CORTIZO PE´REZ AINet Solutions Fuenlabrada 28943, Madrid, Spain

Abstract In recent years, email spam has become an increasingly important problem, with a big economic impact in society. In this work, we present the problem of spam, how it affects us, and how we can fight against it. We discuss legal, economic, and technical measures used to stop these unsolicited emails. Among all the technical measures, those based on content analysis have been particularly effective in filtering spam, so we focus on them, explaining how they work in detail. In summary, we explain the structure and the process of different Machine Learning methods used for this task, and how we can make them to be cost sensitive through several methods like threshold optimization, instance weighting, or MetaCost. We also discuss how to evaluate spam filters using basic metrics, TREC metrics, and the receiver operating characteristic convex hull method, that best suits classification problems in which target conditions are not known, as it is the case. We also describe how actual filters are used in practice. We also present different methods used by spammers to attack spam filters and what we can expect to find in the coming years in the battle of spam filters against spammers.


45


46

E.P. SANZ ET AL.

1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 1.1. 1.2. 1.3. 1.4.

What is Spam? . . . . . . . . The Problem of Email Spam . Spam Families . . . . . . . . Legal Measures Against Spam

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

47 47 48 50

2. Technical Measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 2.1. 2.2. 2.3. 2.4. 2.5. 2.6. 2.7. 2.8. 2.9.

Primitive Language Analysis or Heuristic Content Filtering . . . . . White and Black Listings . . . . . . . . . . . . . . . . . . . . . . . Graylisting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Digital Signatures and Reputation Control . . . . . . . . . . . . . . Postage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Disposable Addresses . . . . . . . . . . . . . . . . . . . . . . . . . Collaborative Filtering . . . . . . . . . . . . . . . . . . . . . . . . Honeypotting and Email Traps . . . . . . . . . . . . . . . . . . . . Content-Based Filters . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . .

. . . . . . . . .

. . . . . . . . .

. . . . . . . . .

51 51 52 53 54 54 55 55 56

3. Content-Based Spam Filtering . . . . . . . . . . . . . . . . . . . . . . . . 56 3.1. 3.2. 3.3. 3.4.

Heuristic Filtering . . . . . . . . . . . . . . . . . . . Learning-Based Filtering . . . . . . . . . . . . . . . Filtering by Compression . . . . . . . . . . . . . . . Comparison and Summary . . . . . . . . . . . . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

57 63 80 83

4. Spam Filters Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 4.1. 4.2. 4.3.

Test Collections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Running Test Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Evaluation Metrics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

5. Spam Filters in Practice . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 5.1. 5.2. 5.3. 5.4.

Server Side Versus Client Side Filtering . . . . . . . . . . . Quarantines . . . . . . . . . . . . . . . . . . . . . . . . . . Proxying and Tagging . . . . . . . . . . . . . . . . . . . . . Best and Future Practical Spam Filtering . . . . . . . . . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

. . . .

93 95 96 98

6. Attacking Spam Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 6.1. 6.2. 6.3.

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Indirect Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Direct Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

7. Conclusions and Future Trends . . . . . . . . . . . . . . . . . . . . . . . . 109 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

EMAIL SPAM FILTERING

47

1. Introduction 1.1

What is Spam?

In literature, we can find several terms for naming unsolicited emails. Junk emails, bulk emails, or unsolicited commercial emails (UCE) are a few of them, but the most common word used for reference is ‘spam.’ It is not clear where do the word spam comes from, but many authors state that the term was taken from a Monty Python’s sketch, where a couple go into a restaurant, and the wife tries to get something other than spam. In the background are a bunch of Vikings that sing the praises of spam: ‘spam, spam, spam, spam . . . lovely spam, wonderful spam.’ Pretty soon the only thing you can hear in the skit is the word ‘spam.’ That same idea would happen to the Internet if large-scale inappropriate postings were allowed. You could not pick the real postings out from the spam. But, what is the difference between spam and legitimate emails? We can consider an email as spam if it has the following features: l l l

Unsolicited: The receiver is not interested in receiving the information. Unknown sender: The receiver does not know and has no link with the sender. Massive: The email has been sent to a large number of addresses.

In the next subsections, we describe the most prominent issues regarding spam, including its effects, types, and main measures against it.

1.2

The Problem of Email Spam

The problem of email spam can be quantified in economical terms. Many hours are wasted everyday by workers. It is not just the time they waste reading spam but also the time they spend deleting those messages. Let us think in a corporate network of about 500 hosts, and each one receiving about 10 spam messages every day. If because of these emails 10 min are wasted we can easily estimate the large number of hours wasted just because of spam. Whether an employee receives dozens or just a few each day, reading and deleting these messages takes time, lowering the work productivity. As an example, the United Nations Conference on Trade and Development estimates the global economic impact of spam could reach $20 b in lost time and productivity. The California legislature found that spam costs United States organizations alone more than $10 b in 2004, including lost productivity and the additional equipment, software, and

48

E.P. SANZ ET AL.

manpower needed to combat the problem. A repost made by Nucleus Research1 in 2004 claims that spam will cost US employers $2K per employee in lost productivity. Nucleus found that unsolicited email reduced employee productivity by a staggering 1.4%. Spam-filtering solutions have been doing little to control this situation, reducing spam levels by only 26% on average, according to some reports. There are also problems related to the technical problems caused by spam. Quite often spam can be dangerous, containing virus, trojans, or other kind of damaging software, opening security breaches in computers and networks. In fact, it has been demonstrated that virus writers hire spammers to disseminate their so-called malware. Spam has been the main means to perform ‘phishing’ attacks, in which a bank or another organization is supplanted in order to get valid credentials from the user, and steal his banking data leading to fraud. Also, network and email administrators have to employ substantial time and effort in deploying systems to fight spam. As a final remark, spam is not only dangerous or a waste of time, but also it can be quite disturbing. Receiving unsolicited messages is a privacy violation, and often forces the user to see strongly unwanted material, including pornography. There is no way to quantify this damage in terms of money, but no doubt it is far from negligible.

1.3

Spam Families

In this subsection, we describe some popular spam families or genres, focusing on those we have found most popular or damaging.

1.3.1 Internet Hoaxes and Chain Letters There are a whole host of annoying hoaxes that circulate by email and encourage you to pass them on to other people. Most hoaxes have a similar pattern. These are some common examples to illustrate the language used: l

l

l

1

Warnings about the latest nonexistent virus dressed up with impressive but nonsensical technical language such as ‘nth-complexity binary loops.’ Emails asking to send emails to a 7-year-old boy dying of cancer, promises that one well-known IT company’s CEO or president will donate money to charity for each email forwarded. Messages concerning the Helius Project, about a nonexistent alien being communicating with people on Earth, launched in 2003 and still online. Many people who interacted with Helius argue that Helius is real. See http://www.nucleusresearch.com for more information.


49

In general, messages that says ‘forward this to everyone you know!’ are usually hoaxes or chain letters. The purpose of these letters is from joking to generating important amounts of network traffic that involves economic losses in ISPs.

1.3.2 Pyramid Schemes This is a common attempt to get money from people. Pyramid schemes are worded along the lines of ‘send ten dollars to this address and add yourself to the bottom of the list. In six weeks you’ll be a millionaire!’ They do not work (except from the one on the top of the pyramid, of course). They are usually illegal and you will not make any money from them.

1.3.3 Advance Fee Fraud Advance fee fraud, also known as Nigerian fraud or 419 fraud, is a particularly dangerous spam. It takes the form of an email claiming to be from a businessman or government official, normally in a West African state, who supposedly has millions of dollars obtained from the corrupt regime and would like your help in getting it out of the country. In return for depositing the money in your bank account, you are promised a large chunk of it. The basic trick is that after you reply and start talking to the fraudsters, they eventually ask you for a large sum of money up front in order to get an even larger sum later. You pay, they disappear, and you lose.

1.3.4 Commercial Spam This is the most common family of spam messages. They are commercial advertisements trying to sell a product (that usually cannot be bought in a regular store). According to a report made by Sophos about security threats in 2006,2 health- and medical-related spam (which primarily covers medication which claims to assist in sexual performance, weight loss, or human growth hormones) remained the most dominant type of spam and rose during the year 2006. In the report we find the top categories in commercial spam: l l

l

2

Medication/pills – Viagra, Cialis, and other sexual medication. Phishing scams – Messages supplanting Internet and banking corporations like Ebay, Paypal, or the Bank of America, in order to get valid credentials and steal users’ money. Non-English language – an increasing number of commercial spam is translated or specifically prepared for non-English communities. See the full report at http://www.sophos.com.

50 l

l

l l

E.P. SANZ ET AL.

Software – or how you can get very cheap, as it is OEM (Original Equipment Manufacturer), that is, prepared to be served within a brand new PC at the store. Mortgage – a popular category, including not only mortgages but also specially debt grouping. Pornography – one of the most successful businesses in the net. Stock scams – interestingly, it has been observed that promoting stock corporations via email has had some impact in their results.

The economics behind the spam problem are clear: if users did not buy products marketed through spam, it would not be such a good business. If you are able to send 10 million messages for a 10 dollars product, and you get just one sell among every 10 thousand messages, you will be getting 10 thousand dollars from your spam campaign. Some spammers have been reported earning around five hundred thousand dollars a month, for years.

1.4

Legal Measures Against Spam

Fighting spam requires uniform international laws, as the Internet is a global network and only uniform global legislation can combat spam. A number of nations have implemented legal measures against spam. The United States of America has both a federal law against spam and a separate law for each state. Something similar can be found in Europe: the European Union has its antispam law but most European countries have its own spam law too. There are specially effective or very string antispam laws like those in Australia, Japan, and South Korea. There are also bilateral treaties on spam and Internet fraud, as those between the United States and Mexico or Spain. On the other side, there are also countries without specific regulation about spam so it is an activity that is not considered illegal. With this scenario, it is very difficult to apply legal measures against spammers. Besides that, anonymity is one of the biggest advantages of spammers. Spammers frequently use false names, addresses, phone numbers, and other contact information to set up ‘disposable’ accounts at various Internet service providers. In some cases, they have used falsified or stolen credit card numbers to pay for these accounts. This allows them to quickly move from one account to the next as each one is discovered and shut down by the host ISPs. While some spammers have been caught (a noticeable case is that of Jeremy Jaynes), there are many spammers that have avoided their capture for years. A trustable spammers’ hall of fame is maintained by The Spamhaus Project, and it is known as the Register Of Known Spam Operations (ROKSO).3

3

The ROKSO can be accessed at http://www.spamhaus.org/rokso/index.lasso.


2.

51

Technical Measures

Among all the different techniques used for fighting spam, technical measures have become the most effective. There are several approaches used to filter spam. In the next section, we will comment some of the most popular approaches.

2.1

Primitive Language Analysis or Heuristic Content Filtering

The very first spam filters used primitive language analysis techniques to detect junk email. The idea was to match specific texts or words to email body or sender address. In the mid 1990s when spam was not the problem that it is today, users could filter unsolicited emails by scanning them, searching for phrases or words that were indicative of spam like ‘Viagra’ or ‘Buy now.’ Those days spam messages were not as sophisticated as they are today and this very simplistic approach could filter ~80% of the spam. The first versions of the most important email clients included this technique that it worked quite well for a time, before spammers started to use their tricks to avoid filters. The way they obfuscated messages made this technique ineffective. Another weakness of this approach was the high false-positive rate: any message containing ‘forbidden words’ was sent to trash. Most of those words were good for filtering spam, but sometimes they could appear in legitimate emails. This approach is not used nowadays because of the low accuracy and the high error rates it has. This primitive analysis technique is in fact a form of content analysis, as it makes use of every email content to decide if it is spam or legitimate. We have called this technique heuristic filtering, and it is extensively discussed below.

2.2

White and Black Listings

White and black lists are extremely popular approaches to filter spam email [41]. White lists state which senders’ messages are never considered spam, and black lists include those senders that should always be considered spammers. A white list contains addresses that are supposed to be safe. These addresses can be individual emails, domain names, or IP addresses, and it would filer an individual sender or a group of them. This technique can be used in the server side and/or in the client side, and is usually found as a complement to other more effective approaches. In server-side white lists, an administrator has to validate the addresses before they go to the trusted list. This can be feasible in a small company or a server with a small number of email accounts, but it can turn into a pain if pretended to be used in large corporate servers with every user having his own white list. This is because the

52

E.P. SANZ ET AL.

task of validating each email that is not in the list is a time-consuming job. An extreme use of this technique could be to reject all emails coming from senders that are not in the white list. This could sound very unreasonable, but it is not. It can be used in restricted domains like schools, where you prefer to filter emails from unknown senders but want to keep the children away from potentially harmful content, because spam messages could contain porn or another kind of adult content. In fact, this aggressive antispam technique has been used by some free email service providers as Hotmail, in which a rule can be stated preventing any message coming from any other service to get into their users mailboxes. White listings can also be used in the client side. In fact, one of the first techniques used to filters spam consisted of using user’s address book as a white list, tagging as potential spam all those emails that had in the FROM: field an address that was not in the address book. This technique can be effective for those persons who use email just to communicate with a limited group of contacts like family and friends. The main problem of white listings is the assumption that trusted contacts do not send junk email and, as we are going to see, this assumption could be erroneous. Many spammers use computers that have been compromised using trojans and viruses for sending spam, sending them to all the contacts of the address book, so we could get a spam message from a known sender if his computer has been infected with a virus. Since these contacts are in the white list, all messages coming from them are flagged as safe. Black listings, most often known as DNS Blacklists (DNSBL), are used to filter out emails which are sent by known spam addresses or compromised servers. The very first and most popular black list has been the trademarked Realtime Blackhole List (RBL), operated by the Mail Abuse Prevention System. System administrators, using spam detection tools, report IP addresses of machines sending spam and they are stored in a common central list that can be shared by other email filters. Most antispam softwares have some form of access to networked resources of this kind. Aggressive black listings may block whole domains or ISPs having many false positives. A way to deal with this problem is to have several distributed black listings and contrast sender’s information against some of them before blocking an email. Current DNS black lists are dynamic, that is, not only grow with new information, but also expire entries, maintaining fresh reflection of current situation in the address space.

2.3

Graylisting

As a complement to white and black listings, one could use graylistings [94]. The core behind this approach is the assumption that junk email is sent using spam bots, this is specific software made to send thousands of emails in a short time. This software differs from traditional email servers and does not respect email RFC standards. In particular, emails that fail to reach its target are not sent again, as a real system would


53

do. This is the right feature used by graylistings. When the system receives an email from an unknown sender that is not in a white listing, it creates a tupla sender–receiver. The first time that tupla occurs in the system, the email is rejected so it is bounced back to the sender. A real server will send that email again so the second time the system finds the tupla, the email is flagged as safe and delivered to the recipient. Graylistings have some limitations and problems. The obvious ones are the delay we could have in getting some legitimate emails when using this approach because we have to wait until the email is sent twice, and the waste of bandwidth produced in the send–reject–resend process. Other limitations are that this approach will not work when spam is sent from open relays as they are real email servers and the easy way for spammer to workaround graylistings, just adding a new functionality to the software, allowing it to send bounced emails again.

2.4

Digital Signatures and Reputation Control

With the emergence of Public Key Cryptography, and specifically, its application to email coding and signing, most prominently represented by Pretty Good Privacy (PGP) [103] and GNU Privacy Guard (GPG) [64], there exists the possibility of filtering out unsigned messages, and in case they are signed, those sent by untrusted users. PGP allows keeping a nontrivial web/chain of trust between email users, the way that trust is spread over a net of contacts. This way, a user can trust the signer of a message if he or she is trusted by another contact of the email receiver. The main disadvantage of this approach is that PGP/GPG users are rare, so it is quite risky to consider legitimate email coming only from trusted contacts. However, it is possible to extend this idea to email servers. As we saw in previous section, many email filters use white listings to store safe senders, usually local addresses and addresses of friends. So if spammers figure out who our friends are, they could forge the FROM: header of the message with that information, avoiding filters because senders that are in white listings are never filtered out. Sender Policy Framework (SPF), DomainKeys, and Sender ID try to prevent forgery by registering IPs of machines used to send email from for every valid email sender in the server [89]. So if someone is sending an email from a particular domain but it does not match the IP address of the sender, you can know the email has been forged. The messages are signed by the public key of the server, which makes its SPF, DomainKeys, or Sender ID record public. As more and more email service providers (specially the free ones, like Yahoo!, Hotmail, or Gmail) are making their IP records public, the approach will be increasingly effective. Signatures are a basic implementation of a more sophisticated technique, which is reputation control for email senders. When the system receives an email from an unknown sender, the message is scanned and classified as legitimate or spam. If the

54

E.P. SANZ ET AL.

email is classified as legitimate, the reputation of the sender is increased, and decreased if classified as spam. The more emails are sent from that address, the more positive or negative the sender is ranked. Once reputation crosses a certain threshold, it can be moved to a white or black list. The approach can be extended to the whole IP space in the net, as current antispam products by IronPort feature, named SenderBase.4

2.5

Postage

One of the main reasons of spam success is the low costs of sending spam. Senders do not have to pay for sending email and costs of bandwidth are very low even if sending millions of emails.5 Postage is a technique based upon the principle of senders of unsolicited messages demonstrating their goodwill by paying some kind of postage: either a small amount of money paid electronically, a sacrifice of a few seconds of human time at answering a simple question, or some time of computation in the sender machine. As the email services are based on the Simple Mail Transfer Protocol, economic postage requires a specific architecture over the net, or a dramatic change in the email protocol. Abadi et al. [1] describes a ticket-based client–server architecture to provide postage for avoiding spamming (yet other applications are suitable). An alternative is to require the sender to answer some kind of question, to prove he is actually a human being. This is the kind of Turing Test [93] that has been implemented in many web-based services, requiring the user to type the hidden word in a picture. These tests are named CAPTCHAs (Completely Automated Public Turing test to tell Computers and Humans Apart) [2]. This approach can be especially effectively used to avoid outgoing spam, that is, preventing the spammers to abuse of free email service providers as Hotmail or Gmail. A third approach is requiring the sender machine to solve some kind of computationally expensive problem [32], producing a delay and thus, disallowing spammers to send millions of messages per day. This approach is, by far, the less annoying of the postage techniques proposed, and thus, the most popular one.

2.6 Disposable Addresses Disposable addresses [86] are a technique used to prevent a user to receive spam. It is not a filtering system itself but a way to avoid spammers to find out our address. To harvest email addresses, spammers crawl the web searching for addresses in web 4

The level of trust of an IP in SenderBase can be checked at: http://www.senderbase.org/. Although the case against the famous spammer Jeremy Jaynes has revealed he has been spending more than one hundred thousand dollars per month in high speed connections. 5


55

pages, forums, or Usenet groups. If we do not publish our address on the Internet, we can be more or less protected against spam, but the problem is when we want to register in a web page or an Internet service and we have to fill in our email address in a form. Most sites state that they will not use that information for sending spam but we cannot be sure and many times the address goes to a list that is sold to third party companies and used for sending commercial emails. Moreover, these sites can be accessed by hackers with the purpose of collecting valid (and valuable) addresses. To circumvent this problem, we can use disposable email addresses. Instead of letting the user prepare his own disposable addresses, he can be provided with an automatic system to manage them, like the channels’ infrastructure by ATT [50]. The addresses are temporary accounts that the user can use to register in web services. All messages sent to disposable address are redirected to our permanent safe account during a configurable period of time. Once the temporary address is no longer needed, it is deleted so even if that account receives spam, this is not redirected.

2.7

Collaborative Filtering

Collaborative filtering [48] is a distributed approach to filter spam. Instead of having each user to have his own filter, a whole community works together. Using this technique, each user shares his judgments of what is spam and what is not with the other users. Collaborative filtering networks take advantage of the problem of some users that receive spam to build better filters for those that have not yet received those spam messages. When a group of users in the same domain have tagged an email coming from a common sender as spam, the system can use the information in those emails to learn to classify those particular emails so the rest of users in the domain will not receive them. The weakness of this approach is that what is spam for somebody could be a legitimate content for another. These collaborative spam filters cannot be more accurate as a personal filter in the client side but it is an excellent option for filtering in the server side. Another disadvantage of this approach is that spammers introduce small variations in the messages, disallowing the identification of a new upcoming spam email as a close variation of one receiver earlier by another user [58].

2.8

Honeypotting and Email Traps

Spammers are known to abuse vulnerable systems like open mail relays and public open proxies. In order to discover spam activities, some administrators have created honeypot programs that simulate being such vulnerable systems. The existence of such fake systems makes more risky for spammers to use open relays

56

E.P. SANZ ET AL.

and open proxies for sending spam. Honeypotting is a common technique used for system administrators to detect hacking activities on their servers. They create fake vulnerable servers in order to burst hackers while protecting the real servers. Since the term honeypotting is more appropriate for security environments, the terms ‘email traps’ or ‘spam traps’ can be used instead of referring to these techniques when applied to prevent spam. Spam traps can used to collect instances of spam messages on keeping a fresh collection of spammer techniques (and a better training collection in learning-based classifiers), to build and deploy updated filtering rules in heuristic filters, and to detect new spam attacks in advance, avoiding them reach, for example, a corporate network in particular.

2.9

Content-Based Filters

Content-based filters are based on analyzing the content of emails. These filters can be hand-made rules, also known as heuristic filters, or learned using Machine Learning algorithms. Both approaches are widely used these days in spam filters because they can be very accurate when they are correctly tuned up, and they are going to be deeply analyzed in next section.

3.

Content-Based Spam Filtering

Among the technical measures to control spam, content-based filtering is one of the most popular ones. Spam filters that analyze the contents of the messages and take decisions on that basis have spread among the Internet users, ranging from individual users at their home personal computers, to big corporate networks. The success of content-based filters is so big that spammers have performed increasingly complex attacks designed to avoid them and to reach the users’ mailbox. This section covers the most relevant techniques for content-based spam filtering. Heuristic filtering is important for historical reasons, although the most popular modern heuristic filters have some learning component. Learning-based filtering is the main trend in the field; the ability to learn from examples of spam and legitimate messages gives these filters full power to detect spam in a personalized way. Recent TREC [19] competitive evaluations have stressed the importance of a family of learning-based filters, which are those using compression algorithms; they have scored top in terms of effectiveness, and so they deserve a specific section.


3.1

57

Heuristic Filtering

Since the very first spam messages, users (that were simultaneously their own ‘network administrators’) have coded rules or heuristics to separate spam from their legitimate messages, and avoid reading the first [24]. A content-based heuristic filter is a set of hand-coded rules that analyze the contents of a message and classify it as spam or legitimate. For instance, a rule may look like: if ðP‘Viagra’ 2 MÞorð‘VIAGRA’ 2 MÞthen classðMÞ ¼ spam This rule means that if any of the words ‘Viagra’ or ‘VIAGRA’ (that are in fact distinct characters strings) occur in a message M, then it should be classified as spam. While first Internet users were often privileged user administrators and used this kind of rules in the context of sophisticated script and command languages, most modern mail user clients allow writing this kind of rules through simple forms. For instance, a Thunderbird straightforward spam filter is shown in Fig. 1. In this example, the users has prepared a filter named ‘spam’ that deletes all messages in which the word ‘**spam**’ occurs in the Subject header.

FIG. 1. A simple spam filter coded as a Thunderbird mail client rule. If the word ‘**spam**’ occurs in the Subject of a message, it will be deleted (sent to trash).

58

E.P. SANZ ET AL.

However, these filtering utilities are most often used to classify the incoming messages into folders, according to their sender, their topic, or the mail list they belong to. They can also be used in conjunction with a filtering solution out of the mail client, which may tag spam messages (for instance, with the string ‘**spam**’ in the subject, or being more sophisticate, by adding a specific header like, for example, X-mail report, which can include a simple tag or a rather informative output with even a score), that will be later processed by the mail client by applying the suitable filters and performing the desired action. A sensible action is to send the messages tagged as spam to a quarantine folder in order to avoid false positives (legitimate messages classified as spam). It should be clear that maintaining an effective set of rules can be a rather time-consuming job. Spam messages include offers of pharmacy products, porn advertisements, unwanted loans, stock recommendations, and many other types of messages. Not only their content, but their style is always changing. In fact, it is hard to find a message in which the word ‘Viagra’ occurs without alterations (except for a legitimate one!). In other words, there are quite many technical experts highly committed to make the filter fail: the spammers. This is why spam filtering is considered a problem of ‘adversarial classification’ [25]. Neither a modern single network administrator nor even an advanced user will be writing their own handmade rules to filter spam. Instead, a list of useful rules can be maintained by a community of expert users and administrators, as it has been done in the very popular open-source solution SpamAssassin or in the commercial service Brightmail provided by Symantec Corporation. We discuss these relevant examples in the next subsections, finishing this section with the advantages and disadvantages of this approach.

3.1.1 The SpamAssassin Filter While it is easy to defeat a single network administrator, it is harder to defeat a community. This is the spirit of one of the most spread heuristic filtering solutions: SpamAssassin [87]. This filter has received a number of prices, and as a matter of example, it had more than 3600 downloads in the 19 months the project was hosted at Sourceforge6 (February 2002–September 2003). SpamAssassin is one of the oldest still-alive filters in the market, and its main feature (for the purpose of our presentation) is its impressive set of rules or heuristics, contributed by tens of administrators and validated by the project 6 Sourceforge is the leading hosting server for open-source projects, providing versioning and downloading services, statistics, and more. See: http://sourceforge.net.


59

committee. The current (version 3.2) set of rules (named ‘tests’ in SpamAssassin) has 746 tests.7 Some of them are administrative, and a number of them are not truly ‘content-based,’ as they, for example, check the sender address or IP against public white lists. For instance, the test named ‘RCVD_IN_DNSWL_HI’ checks if the sender is listed in the DNS Whitelist.8 Of course, this is a white listing mechanism, and it makes nearly no analysis of the very message content. On the other side, the rule named ‘FS_LOW_RATES’ tests if the Subject field contains the words ‘low rates,’ which is very popular in spam messages dealing with loans or mortgages. Many SpamAssassin tests address typing variability by using quite sophisticated regular expressions. We show a list of additional examples in the Fig. 2, as they are presented in the project web page. A typical SpamAssassin content matching rule has the structure shown in the next example: body DEMONSTRATION_RULE /test/ score DEMONSTRATION_RULE 0.1 describe DEMONSTRATION_RULE This is a simple test rule

The rule starts with a line that describes the test to be performed, it goes on with line presenting the score, and it has a final line for the rule description. The sample rule name is ‘DEMONSTRATION_RULE,’ and it checks the (case sensitive) occurrence of the word ‘test’ in the body section of an incoming email message. If the condition is

FIG. 2. A sample of SpamAssassin test or filtering rules. The area tested may be the header, the body, etc. and each test is provided with one or more scores that can be used to set a suitable threshold and vary the filter sensitivity. 7

The lists of tests used by SpamAssassin are available at: http://spamassassin.apache.org/tests.

html. 8

The DNS Whitelist is available at: http://www.dnswl.org/.

60

E.P. SANZ ET AL.

satisfied, that is, the word occurs, then the score 0.1 is added to the message global score. The score of the message may be incremented by other rules, and the message will be tagged as spam if the global score exceeds a manually or automatically set threshold. Of course, the higher the score of a rule, the more it contributes to the decision of tagging a message as spam. The tests performed in the rules can address all the parts in a message, and request preprocessing or not. For instance, if the rule starts with ‘header,’ only the headers will be tested: header DEMONSTRATION_SUBJECT Subject = /test/

In fact, the symbols ‘=~’ preceding the test, along with the word ‘Subject,’ mean that only the subject header will be tested. This case, the subject field name is case insensitive. The tests performed allow complex expressions written in the Perl Regular Expressions (Regex) Syntax. A slightly more complex example may be: header DEMONSTRATION_SUBJECT Subject = /\btest\b/i

In this example, the expression ‘/ \btest\b/i’ means that the word ‘test’ will be searched as a single word (and not as a part of others, like ‘testing’), because it starts and finishes with the word-break mark ‘\b,’ and the test will be case insensitive because of the finishing mark ‘/i.’ Of course, regular expressions may be much more complex, but covering them in detail is beyond the scope of this chapter. We suggest [54] for the interested reader. Manually assigning scores to the rules is not a very good idea, as the rule coder must have a precise and global idea of all the scores in all the rest of the rules. Instead, an automated method is required, which should be able to look at all the scores and a set of testing messages, and compute the scores that minimize the error of the filter. In versions 2.x, the scores of the rules have been assigned using a Genetic Algorithm, while in (current) versions 3.x, the scores are assigned using a neural network trained with error back propagation (a perceptron). Both systems attempt to optimize the effectiveness of the rules that are run in terms of minimizing the number of false positives and false negatives, and they are presented in [87] and [91], respectively. The scores are optimized on a set of real examples contributed by volunteers. The SpamAssassin group has in fact released a corpus of spam messages, the sonamed SpamAssassin Public Corpus.9 This corpus includes 6047 messages, with ~31% spam ratio. As it has been extensively used for the evaluation of content-based spam filter, we leave a more detailed description of it for Section 4.

9

The SpamAssassin Public Corpus is available at: http://spamassassin.apache.org/publiccorpus/.

61


3.1.2 The Symantec Brightmail Solution Some years ago, Brightmail emerged as an antispam solution provider based on an original business model in the antispam market. Instead of providing a final software application with filtering capabilities, it focused more on the service, and took the operation model from antivirus corporations: analysts working 24 h a day on new attacks, and frequent delivering of new protection rules. The model succeeded, and on June 21st, 2004, Symantec Corporation acquired Brightmail Incorporated, with its solution and its customers. Nowadays, Symantec claims that Brightmail Anti-spam protects more than 300 million users, and filters over 15% of the worldwide emails. The Brightmail Anti-spam solution works at the clients’ gateway, scanning incoming messages to the corporation, and deciding if they are spam or not. The decision is taken on the basis of a set of filtering rules provided by the experts working in the Symantec operations center, named BLOC (Brightmail Logistics Operations Center). The operational structure of the solution is shown in Fig. 3. In this figure, circles are used to denote the next processing steps: 1. The Probe Network (TM) is a network of fake email boxes (‘spam traps’ or ‘honeypots’) that have been seeded with the only purpose of receiving spam. These email addresses can be collected only by automatic means, as spammers

Symantec Operations Center Probe NetworkTM Spam

Corporation place

BLOCTM Collected spam

Filter hand coding 27⫻7 service

Internet

Reputation data collected

Legitimate Spam email

2

Filter validation

Secure filter trans. 3

4 Symantec Brightmail anti-spam

Email Gateway

Filter distribution 1

Email server

quarrantine

5

Spam 6

User mailbox

FIG. 3. Operational structure of the Symantec Brightmail Anti-spam solution. The numbers in circles denote processes described.

62

2.

3. 4. 5.

6.

E.P. SANZ ET AL.

do, and in consequence, they can receive only spam emails. The spam collected is sent to the BLOC. At the BLOC, groups of experts and, more recently, content-based analysis automatic tools build, validate, and distribute antispam filters to Symantec corporate customers. Every 10 min, the Symantec software downloads the most recent version of the filters from the BLOC, in order to keep them as updated as possible. The software filters the incoming messages using the Symantec and the usercustomized filters. The email administrator determines the most suitable administration mode for the filtered email. Most often, the (detected as) spam email is kept into a quarantine where users can check if the filter has mistakenly classified a legitimate message as spam (a false positive). The users can report undetected spam to Symantec for further analysis.

The processes at the BLOC were once manual, but the ever-increasing number of spam attacks has progressively made impossible to approach filter building as a hand-made task. In the recent times, spam experts in the BLOC have actually switched their role to filter adapters and tuners, as the filters are being produced by using the automatic, learning-based tools described in the next section.

3.1.3 Problems in Heuristic Filtering Heuristic content-based filtering has clear advantages over other kinds of filtering, especially those based on black and white listing. The most remarkable one is that it filters not only on the ‘From’ header, but also it can make use of the entire message, and inconsequence, to make a more informed decision. Furthermore, it offers a lot of control on the message information that is scanned, as the filter programmer decides which areas to scan, and what to seek. However, heuristic filtering has two noticeable drawbacks. First, writing rules is not an easy task. Or it has to be left on the hands of an experienced email administrator, or it has to be simplified via the forms in commercial mail clients as described above. The first case usually involves some programming, probably including a bit of regular expression definition, which is hard and error-prone. The second one implies a sacrifice of flexibility to gain simplicity. The second drawback is that, even being the rules written by a community of advanced users or administrators, the number of spammers is bigger, and moreover, they have a strong economic motivation to design new methods to avoid detection. In this arms race, the spammers will be always having the winning hand if the work of administrators is not supported with automatic (learning-based) tools as those we describe in the next section.


3.2

63

Learning-Based Filtering

During the past 9 years, a new paradigm of content-based spam filtering has emerged. Bayesian filters, or more in general, learning-based filters, have the ability to learn from the email flow and to improve their performance over time, as they can adapt themselves to the actual spam and legitimate email a particular user receives. Their impressive success is demonstrated by the deep impact they have had on spam email, as the spammers have to costly change their techniques in order to avoid them. Learning-based filters are the current state of the art of email filtering, and the main issue in this chapter.

3.2.1 Spam Filtering as Text Categorization Spam filtering is an instance of a more general text classification task named Text Categorization [85]. Text Categorization is the assignment of text documents to a set of predefined classes. It is important to note that the classes are preexistent, instead of being generated on the fly (what corresponds to the task of Text Clustering). The main application of text categorization is the assignment of subject classes to text documents. Subject classes can be web directory categories (like in Yahoo!10), thematic descriptors in libraries (like the Library of Congress Subject Headings11 or, in particular domains, the Medical Subject Headings12 by the National Library of Medicine, or the Association for Computing Machinery ACM’s Computing Classification System descriptors used in the ACM Digital Library itself ), personal email folders, etc. The documents may be Web sites or pages, books, scientific articles, news items, email messages, etc. Text Categorization can be done manually or automatically. The first method is the one used in libraries, where expert catalogers scan new books and journals in order to get them indexed according to the classification system used. For instance, the National Library of Medicine employs around 95 full-time cataloguers in order to index the scientific and news articles distributed via MEDLINE.13 Obviously this is a time- and money-consuming task and the number of publications is always increasing. The increasing availability of tagged data has allowed the application of Machine Learning methods to the task. Instead of hand classifying the documents, or manually building a classification system (as what we have named a heuristic filter 10

Available at: http://www.yahoo.com/. Available at: http://www.loc.gov/cds/lcsh.html. 12 Available at: http://www.nlm.nih.gov/mesh/. 13 James Marcetich, Head of the Cataloguing Section of the National Library of Medicine, in personal communication (July 18, 2001). 11

64

E.P. SANZ ET AL.

above), it is possible to automatically build a classifier by using a Machine Learning algorithm on a collection of hand-classified documents suitably represented. The administrator or the expert does not have to write the filter, but let the algorithm learn the document properties that make them suitable for each class. This way, the traditional expert system ‘knowledge acquisition bottleneck’ is alleviated, as the expert can keep on doing what he or she does best (that is, in fact, classifying), and the system will be learning from his decisions. The Machine Learning approach has achieved considerable success in a number of tasks, and in particular, in spam filtering. In words by Sebastiani: (Automated Text Categorization) has reached effectiveness levels comparable to those of trained professionals. The effectiveness of manual Text Categorization is not 100% anyway (. . .) and, more importantly, it is unlikely to be improved substantially by the progress of research. The levels of effectiveness of automated TC are instead growing at a steady pace, and even if they will likely reach a plateau well below the 100% level, this plateau will probably be higher than the effectiveness levels of manual Text Categorization. [85] (p. 47)

Spam filtering can be considered an instance of (Automated) Text Categorization, in which the documents to classify are the user email messages, and the classes are spam and legitimate email. It may be considered easy, as it is a single-class problem, instead of the many classes that are usually considered in a thematic TC task.14 However, it shows special properties that makes it a very difficult task: 1. Both the spam and the complementary class (legitimate email) are not thematic, that is, they can contain messages dealing with several topics or themes. For instance, as of 1999, a 37% of the spam email was ‘get rich quick’ letters, a 25% was pornographic advertisements, and an 18% were software offers. The rest of the spam included Web site promos, investment offers, (fake) health products, contests, holidays, and others. Moreover, some of the spam types can overlap with legitimate messages, both commercial and coming from distribution lists. While the percentages have certainly changed (health and investment offers are now most popular), this demonstrates that current TC systems that relay on words and features for classification may have important problems because the spam class is very fragmented. 2. Spam has an always changing and often skewed distribution. For instance, according to the email security corporation MessageLabs [66], spam has gone from 76.1% of the email sent in the first quarter of 2005, to 56.9% in the first quarter of 2006, and back to 73.5% in the last quarter of 2006. On one side, 14 The Library of Congress Subject Headings 2007 edition has over 280000 total headings and references.


65

Machine Learning classifiers expect the same class distribution they learnt from; any variation of the distribution may affect the classifier performance. On the other, skewed distributions like 90% spam (reached in 2004) may make a learning algorithm to produce a trivial acceptor, that is, a classifier that always classifies a message as spam. This is due to the fact that Machine Leaning algorithms try to minimize the error or maximize the accuracy, and the trivial acceptor is then 90% accurate. And even worse, the spam rate can vary from place to place, from company to company, and from person to person; in that situation, is very difficult to build a fit-them-all classifier. 3. Like many other classification tasks, spam filtering has imbalanced misclassification costs. In other words, the kinds of mistakes the filter makes are significant. No user will be happy with a filter that catches 99% of spam but that deletes a legitimate message once-a-day. This is because false positives (legitimate messages classified as spam) are far more costly than false negatives (spam messages classified as legitimate, and thus, reaching the users’ inbox). But again, it is not clear which proportion is right: a user may accept a filter that makes a false positive per 100 false negatives or per 1,000, etc. It depends on the user’s taste, the amount of spam he or she receives, the place where he or she lives, the kind of email account (work or personal), etc. 4. Perhaps the most difficult issue with spam classification is that it is an instance of adversarial classification [25]. An adversarial classification task is one in which there exists an adversary that modifies the data arriving at the classifier in order to make it fail. Spam filtering is perhaps the most representative instance of adversarial classification, among many others like computer intrusion detection, fraud detection, counter-terrorism, or a much related one: web spam detection. In this latter task, the system must detect which webmasters manipulate pages and links to inflate their rankings, after reverse engineering the ranking algorithm. The term spam, although coming from the email arena, is so spread that it is being used for many other fraud problems: mobile spam, blog spam, ‘spim’ (spam over Instant Messaging), ‘spit’ (spam over Internet Telephony), etc. Regarding spam email filtering, standard classifiers like Naı¨ve Bayes were initially successful [79], but spammers soon learned to fool them by inserting ‘nonspam’ words into emails, breaking up ‘spam’ ones like ‘Viagra’ with spurious punctuation, etc. Once spam filters were modified to detect these tricks, spammers started using new ones [34]. In our opinion, these issues make spam filtering a very unusual instance of Automated Text Categorization. Being said this, we must note that the standard structure of an Automated Text Categorization system is suited to the problem of spam filtering, and so we will discuss this structure in the next subsections.

66

E.P. SANZ ET AL.

3.2.2 Structure of Processing The structure of analysis and learning in modern content-based spam filters that make use of Machine Learning techniques, is presented in Fig. 4. In this figure,15 we represent processes or functions as rounded boxes, and information items as plain boxes. The analysis, learning, and retraining (with feedback information) of the classifier are time- and memory-consuming processes, intended to be performed offline and periodically. The analysis and filtering of new messages must be a fast process, to be performed online, as soon as the message arrives at the system. We describe these processes in detail below.

Legitimate email Spam

Incoming message

Analysis and learning

Analysis

Classifier

Message represented

OFFLINE

ONLINE

Filtering

Feedback learning Spam/ legitimate FIG. 4. Processing structure of a content-based spam filter that uses Machine Learning algorithms. 15

That figure is a remake of that by Belkin and Croft for text retrieval in [7].


67

The first step in a learning-based filter is getting a collection of spam and legitimate messages and training a classifier on it. Of course, the collection of messages (the training collection) must represent the operating conditions of the filter as accurately as possible. Machine Learning classifiers often perform poorly when they have been trained on noisy, inaccurate, and insufficient data. There are some publicly available spam/legitimate email collections, discussed in Section 4 because they are most often used as test collections. The first process in the filter is learning a classifier on the training messages, named instances or examples. This process involves analyzing the messages in order to get a suitable representation for learning from them. In this process, the messages are often represented as attribute-value vectors, in which attributes are word tokens in the messages, and values are, for example, binary (the word token occurs on the message or not). Next, a Machine Learning algorithm is fed with the represented examples, and it produces a classifier, that is a model of the messages or a function able to classify new messages if they follow the suitable representation. Message representation and classifier learning are the key processes in a learning-based filter, and so they are discussed in detail in the next subsections. Once the classifier has been trained, it is ready to filter new messages. As they arrive, they are processed in order to represent them according to the format used in the training messages. That typically involves, for instance, ignoring new words in the messages, as classification is made on the basis of known words in the training messages. The classifier receives the represented message and classifies it as spam or legitimate (probably with a probability or a score), and tagged accordingly (or routed to the quarantine, the user mailbox, or whatever). The main strength of Machine Learning-based spam filters is their ability to learn from user relevance judgments, adapting the filter model to the actual email received by the user. When the filter commits a mistake (or depending on the learning mode, after every message), the correct output is submitted to the filter, which stores it for further re-training. This ability is a very noticeable strength, because if every user receives different email, every filter is different (in terms of stored data and model learned), and it is very complex to prepare attacks able to avoid the filters of all users simultaneously. As spammers benefit relies on the number of messages read, they are forced to prepare very sophisticated attacks able to break different vendor filters with different learned models. As we discuss in Section 6, they sometimes succeed using increasingly complex techniques.

3.2.3 Feature Engineering Feature engineering is the process of deciding, given a set of training instances, which properties will be considered for learning from them. The properties are the features or attributes, and they can take different values; this way, every training

68

E.P. SANZ ET AL.

instance (a legitimate or email message) is mapped into a vector in a multidimensional space, in which the dimensions are the features. As many Machine Learning are very slow or just unable to learn in highly dimensional spaces, it is often required to reduce the number of features used in the representation, performing attribute selection (determining a suitable subset of the original attributes) or attribute extraction (mapping the original set of features into a new, reduced set). These tasks are also a part of the feature engineering process.

3.2.3.1

Tokens and Weights. In Text Categorization and spam filtering, the most often used features are the sequences of characters or strings that minimally convey some kind of meaning in a text, that is, the words [39, 85]. More generally, we speak of breaking a text into tokens, a process named tokenization. In fact, this just follows the traditional Information Retrieval Vector Space Model by Salton [81]. This model specifies that, for the purpose of retrieval, texts can be represented as term-weight vectors, in which the terms are (processed) words (our attributes), and weights are numeric values representing the importance of every word in every document. First, learning-based filters have taken relatively simple decisions in this sense, following what was the state of the art on thematic text categorization. The simplest definition of features is words, being a word any sequence of alphabetic characters, and considering any other symbol as a separator or blank. This is the approach followed in the seminal work in this field, by Sahami et al. [79]. This work has been improved by Androutsopoulos et al. [4–6], in which they make use of a lemmatizer (or stemmer), to map words into their root, and a stoplist (a list of frequent words that should be ignored as they bring more noise than meaning to thematic retrieval: pronouns, prepositions, etc.). The lemmatizer used it Morph, included in the text analysis package GATE,16 and the stoplist includes the 100 most frequent words in the British National Corpus.17 In the previous work, the features are binary, that is, the value is one if the token occurs in the message, and zero otherwise. There are several more possible definitions of the weights or values, traditionally coming in the Information Retrieval field. For instance, using the same kind of tokens or features, the authors of [39] and [40] make use of TF.IDF weights. Its definition is the following one: N wij ¼ tfij log2 dfi 16 17

The GATE package is available at: http://gate.ac.uk/. The British National Corpus statistics are available at: http://www.natcorp.ox.ac.uk/.


69

tfij being the number of times that the i-th token occurs in the j-th message, N the number of messages, and dfi the number of messages in which the i-th token occurs. The TF (Term Frequency) part of the weight represents the importance of the token or term in the current document or messages, while the second part IDF (Inverse Document Frequency) gives an ad hoc idea of the importance of the token in the entire document collection. TF weights are also possible. Even relatively straightforward decisions like lowercasing all words, can strongly affect the performance of a filter. The second generation of learning filters has been much influenced by Graham’s work [46, 47], who took advantage of the increasing power and speed of computers to ignore most preprocessing and simplifying decisions taken before. Graham makes use of a more complicated definition of a token: 1. Alphanumeric characters, dashes, apostrophes, exclamation points, and dollar signs are part of tokens, and everything else is a token separator. 2. Tokens that are all digits are ignored, along with HTML comments, not even considering them as token separators. 3. Case is preserved, and there is neither stemming nor stoplisting. 4. Periods and commas are constituents if they occur between two digits. This allows getting IP addresses and prices intact. 5. Price ranges like $20–$25 are mapped to two tokens, $20 and $25. 6. Tokens that occur within the To, From, Subject, and Return-Path lines, or within URLs, get marked accordingly. For example, ‘foo’ in the Subject line becomes ‘Subject*foo.’ (The asterisk could be any character you do not allow as a constituent.) Graham obtained very good results on his personal email by using this token definition and an ad hoc version of a Bayesian learner. This definition has inspired other more sophisticated works in the field, but has also led spammers to focus on tokenization as one of the main vulnerabilities of learning-based filters. The current trend is just the opposite: making nearly no analysis of the text, considering any white-space separated string as a token, and letting the system learn from a really big number of messages (tens of thousands instead of thousands). Even more, HTML is not decoded, and tokens may include HTML tags, attributes, and values.

3.2.3.2 Multi-word Features.

Some researchers have investigated features spanning over two or more tokens, seeking for ‘get rich,’ ‘free sex,’ or ‘OEM software’ patterns. Using statistical word phrases has not resulted into very good results in Information Retrieval [82], leading to even decreases in effectiveness. However, they have been quite successful in spam filtering. Two important works in this line are the ones by Zdziarski [102] and by Yerazunis [100, 101].

70

E.P. SANZ ET AL.

Zdziarski has first used case-sensitive words in his filter Dspam, and latter added what he has called ‘chained tokens.’ These tokens are sequences of two adjacent words, and follow the additional rules: l l l

There are no chains between the message header and the message body. In the message header, there are no chains between individual headers. Words can be combined with nonword tokens.

Chained tokens are not a replacement for individual tokens, but rather a complement to be used in conjunction with them for better analysis. For example, if we are analyzing an email with the phrase ‘CALL NOW, IT’s FREE!,’ there are four tokens created under standard analysis (‘CALL,’ ‘NOW,’ ‘IT’s,’ and ‘FREE!’) and three more chained tokens: ‘CALL NOW,’ ‘NOW IT’s,’ ‘IT’s FREE!.’ Chained tokens are traditionally named word bigrams in the fields of Language Modeling and Information Retrieval. In Table I, we can see how chained tokens may lead to better (more accurate) statistics. In this table, we show the probability of spam given the occurrence of a word, which is the conditional probability usually estimated with the following formula18: PðspamjwÞ

N ðspam; wÞ N ðw Þ

where N(spam, w) is the number of times that w occurs in spam messages, and N(w) is the number of times the word w occurs. Counting can be done also per message: the number of spam messages in which w occurs, and the number of messages in which w occurs. In the table, we can see that the words ‘FONT’ and ‘face’ have probabilities next to 0.5, meaning that they neither support spam nor legitimate email. However, the probability of the bigram is around 0.2, what represents a strong support to the legitimate class. This is due to the fact that spammers and legitimate users use Table I SOME EXAMPLES OF CHAINED TOKENS ACCORDING TO [102] Token words w1=FONT, w2=face w1=color, w2=#000000 w1=that, w2=sent

18

P(spam|w1)

P(spam|w2)

P(spam|w1*w2)

0.457338 0.328253 0.423327

0.550659 0.579449 0.404286

0.208403 0.968415 0.010099

Please note that this is the Maximum Likelihood Estimator.


71

different patterns of HTML code. While the firsts use the codes ad hoc, the seconds generate HTML messages with popular email clients like Microsoft Outlook or Mozilla Thunderbird, that always use the same (more legitimate) patterns, like putting the face attribute of the font next to the FONT HTML tag. We can also see how being ‘color’ and ‘#000000’ quite neutral, the pattern ‘color=#000000’ (the symbol ‘=’ is a separator) is extremely guilty. Zdziarski experiments demonstrate noticeable decreases in the error rates and especially in false positives, when using chained tokens plus usual tokens. Yerazunis follows a slightly more sophisticated approach in [100] and [101]. Given that spammers had already begun to fool learning-based filters by disguising spam-like expressions with intermediate symbols, he proposed to enrich the feature space with bigrams obtained by combining tokens in a sliding 5-words window over the training texts. He has called this Sparse Binary Polynomial Hash (SBPH), and it is implemented in his CRM114 Discriminator filter. In a window, all pairs of sorted words with the second word being the final one are built. For instance, given the phrase/window ‘You can get porn free,’ the following four bigrams are generated: ‘You free,’ ‘can free,’ ‘get free,’ ‘porn free.’ With this feature and what the author calls the Bayesian Chain Rule (a simple application of the Bayes Theorem), impressive results have been obtained on his personal email, claiming that the 99.9% (of accuracy) plateau has been achieved.

3.2.3.3 Feature Selection and Extraction.

Dimensionality reduction is a required step because it improves efficiency and reduces overfitting. Many algorithms perform very poorly when they work with a large amount of attributes (exceptions are k Nearest Neighbors or Support Vector Machines), so a process to reduce the number of elements used to represent documents is needed. There are mainly two ways to accomplish this task: feature selection and feature extraction. Feature selection tries to obtain a subset of terms with the same or even greater predictive power than the original set of terms. For selecting the best terms, we have to use a function that selects and ranks terms according to how good they are. This function measures the quality of the attributes. In the literature, terms are often selected with respect to their information gain (IG) scores [6, 79, 80], and sometimes according to ad hoc metrics [42, 71]. Information gain can be described as: X PðX ¼ x; C ¼ cÞ IGðX; CÞ ¼ PðX ¼ x; C ¼ cÞlog2 P ð X ¼ x Þ Pð C ¼ c Þ x¼0;1;c¼s;l s being the spam class and l the legitimate email class in the above equation. Interestingly, IG is one of the best selection metrics [78]. Other quality metrics are

72

E.P. SANZ ET AL.

Mutual Information [35, 59], w2 [13, 99], Document Frequency [85, 99], or Relevancy Score [95]. Feature extraction is a technique that aims to generate an artificial set of terms different and smaller than the original one. Techniques used for feature extraction in Automated Text Categorization are Term Clustering and Latent Semantic Indexing. Term Clustering creates groups of terms that are semantically related. In particular, cluster group words then can be synonyms (like thesaurus classes) or just in the same semantic field (like ‘pitcher,’ ‘ball,’ ‘homerun,’ and ‘baseball’). Term Clustering, as far as we know, has not been used in the context of spam filtering. Latent Semantic Indexing [27] tries to alleviate the problem produced by polysemy and synonymy when indexing documents. It compresses index vectors creating a space with a lower dimensionality by combining original vectors using patterns of terms that appear together. This algebraic technique has been applied to spam filtering by Gee and Cook with moderate success [37].

3.2.4 Learning Algorithms One of the most important parts in a document classification system is the learning algorithm. Given an ideally perfect classification function F that assigns each message a T/F value,19 learning algorithms have the goal to build a function F that approximates the function F. The approximation function is usually named a classifier, and it often takes the form of model of the data it has been trained in. The most accurate the approximation is, the better the filter will perform. A wide variety of learning algorithms families have been applied to spam classification, including the probabilistic Naı¨ve Bayes [4, 6, 42, 71, 75, 79, 80], rule learners like Ripper [34, 71, 75], Instance Based k-Nearest Neighbors (kNN) [6, 42], Decision Trees like C4.5 [14, 34], linear Support Vector Machines (SVM) [30], classifiers committees like stacking [80] and Boosting [14], and Cost-Sensitive learning [39]. By far, the most often applied learner is the probability-based classifier Naive Bayes. In the next sections, we will describe the most important learning families. To illustrate some of the algorithms that we are going to describe in following sections, we are going to use the public corpus SpamBase.20 The SpamBase collection contains 4,601 messages, being 1,813 (39.4%) spam. This collection has been preprocessed, and the messages are not available in raw form (to avoid privacy problems). Each message is described in terms of 57 attributes, being the first 48 19 Being T equivalent to spam; that is, spam is the ‘‘positive’’ class because it is the class to be detected. 20 This collection can be accessed at: ftp://ftp.ics.uci.edu/pub/machine-learning-databases/spambase/.


73

continuous real [0,100] attributes of type word_freq_WORD (percentage of words in the email that match WORD). A word is a sequence of alphanumeric characters, and the words have been selected as the most unbalanced ones in the collection. The last 9 attributes represent the frequency of special characters like ‘$’ and capital letters. In order to keep examples as simple as possible, we have omitted the nonword features and selected the five attributes with higher Information Gain scores. We have also binarized the attributes, ignoring the percentage values. The word attributes we use are ‘remove,’ ‘your,’ ‘free,’ ‘money,’ and ‘hp.’ The first four words correspond to spammy words, as they occur mainly in spam messages (within expressions like ‘click here to remove your email from this list,’ ‘get free porn,’ or ‘save money’), and the fifth word is a clue of legitimacy, as it is the acronym of the HP corporation in which the email message donors work.

3.2.4.1 Probabilistic Approaches. Probabilistic filters are historically the first filters and have been frequently used in recent years [46, 79]. This approach is mostly used in spam filters because of its simplicity and the very good results it can achieve. This kind of classifiers is based on the Bayes Theorem [61], computing the probability for a document d to belong to a category ck as: Pðck jd Þ ¼

Pðck ÞPðdjck Þ Pð d Þ

This probability can be used to make the decision about whether a document should belong to the category. In order to compute this probability, estimations about the documents in the training set are made. When computing probabilities for spam classification, we can obviate the denominator because we have only two classes (spam and legitimate), and one document cannot be classified in more than one of them, so denominator is the same for every k. Pðck Þ can be estimated as the number of documents in the training set belonging to the category, divided by the total number of documents. Estimating Pðdjck Þ is a bit more complicated because we need in the training set some documents identical to the one we want to classify. When using Bayesian learners, it is very frequent to find the assumption that terms in a document are independent and the order they appear in the document is irrelevant. When this happens, the learner is called ‘Naı¨ve Bayes’ learner [61, 65]. This way probability can be computed in the following way: Pðdjck Þ ¼

T Y i¼1

Pðti jck Þ

74

E.P. SANZ ET AL.

T being the number of terms considered in the documents representation and ti the i-th term (or feature) in the representation. It is obvious that this assumption about term independency is not found in a real domain, but it helps to compute probabilities and rarely affects accuracy [28]. That is the reason why this is the approach used in most works. The most popular version of a Naı¨ve Bayes classifier is that by Paul Graham [46, 47]. Apart from using an ad hoc formula for computing terms probabilities, it makes use of only the 15 most extreme tokens, defined as those occurring in the message that have a probability far from the half point (0.5). This approach leads to more extreme probabilities, and has been proven more effective than using the whole set of terms occurring or not in a message. So strong is the influence of this work in the literature that learning-based filters have been quite often named Bayesian Filters despite using radically different learning algorithms.

3.2.4.2 Decision Trees. One of the biggest problems of probabilistic approaches is that results are not easy to understand for human beings, speaking in terms of legibility. In the Machine Learning field, there are some families of learners that are symbolic algorithms, with results that are easier to understand for people. One of those is the family of Decision Tree learners. A Decision Tree is a finite tree with branches annotated with tests, and leaves being categories. Tests are usually Boolean expressions about term weights in the document. When classifying a document, we move from top to down in the tree, starting in the root and selecting conditions in branches that are evaluated as true. Evaluations are repeated until a leaf is reached, assigning the document to the category that has been used to annotate the leaf. There are many algorithms used for computing the learning tree. The most important ones are ID3 [35], C4.5 [18, 56, 61], and C5 [62]. One of the simplest ways to induce a Decision Tree from a training set of already classified documents is: 1. Verify if all documents belong to the same category. Otherwise, continue. 2. Select a term ti from the document representation and, for every feasible r weight values wir (i.e., 0 or 1), build a branch with a Boolean test ti = wir, and a node grouping all documents that satisfy the test. 3. For each document group, go to 1 and repeat the process in a recursive way. The process ends in each node when all grouped documents in it belong to the same category. When this happens, the node is annotated with the category name.

75


A critical aspect in this approach is how terms are selected. We can usually find functions that measure the quality of the terms according to how good they are separating the set of documents, using Information Gain, or Entropy metrics. This is basically the algorithm used by ID3 system [76]. This algorithm has been greatly improved using better test selection techniques, and tree pruning algorithms. C4.5 can be considered a state of the art in Decision Tree induction. In Fig. 5, we show a portion of the tree learned by C4.5 on our variation of the SpamBase collection. The figure shows how a message that does not contain the words ‘remove,’ ‘money,’ and ‘free’ is classified as legitimate (often called ham), and if does not contain ‘remove,’ ‘money,’ and ‘hp’ but ‘free,’ it is classified as spam. The triangles represent other parts of the tree, omitted for the sake of readability.

3.2.4.3 Rule Learners. Rules of the type ‘if-then’ are the base of one of the concept description languages most popular in Machine Learning field. On one hand, they allow one to present the knowledge extracted using learning algorithms in an easy to understand way. On the other hand, they allow the experts to exanimate and validate that knowledge, and combine it with other known facts in the domain. Rule learners algorithms build this kind of conditional rules, with a logic condition on the left part of it, the premise, and the class name as the consequent, on the

Remove = 0

Money = 0

Free = 0

Remove = 1

Money = 1

Free = 1

HAM hp = 0

SPAM

hp = 1

HAM

FIG. 5. Partial Decision Tree generated by C4.5 using the SpamBase corpus.

76

E.P. SANZ ET AL.

right part. The premise is usually built as a Boolean expression using weights of terms that appear in the document representation. For binary weights, conditions can be simplified to rules that look for if certain combination of terms appears or not in the document. Actually there are several techniques used to induce rules. One of the most popular ones is the algorithm proposed in [68]. It consists of: 1. Iterate building one rule on each step, having the maximum classify accuracy over any subset of documents. 2. Delete those documents that are correctly classified by the rule generated in the previous step. 3. Repeat until the set of pending documents is empty. As in other learners, the criteria for selecting the best terms to build rules in step 1 can be quality metrics like Entropy or Information Gain. Probably the most popular and effective rule learner is Ripper, applied to spam filtering in [34, 71, 75]. If the algorithm is applied to our variation of the SpamBase collection, we get the next four rules: (remove = 1) => SPAM

((free = 1) and (hp = 0)) => SPAM ((hp = 0) and (money = 1)) => SPAM () => HAM The rules have been designed to be applied sequentially. For instance, the second rule is fired by a message that has not fired the first rule (and in consequence, does not contain the word ‘remove’), and that contains ‘free’ but not ‘hp.’ As it can be seen, the fourth rule is a default one that covers all the instances that are not covered by the previous rules.

3.2.4.4 Support Vector Machines. Support Vector Machines (SVM) have been recently introduced in Automatic Classification [55, 56], but they have become very popular rather quickly because of the very good results obtained with these algorithms especially in spam classification [22, 30, 39]. SVMs are an algebraic method, in which maximum margin hyperplanes are built in order to attempt to separate training instances, using, for example, Platt’s sequential minimal optimization algorithm (SMO) with polynomial kernels [72]. Training documents do not need to be linearly separable. Thus, the main method is based on calculation of an arbitrary hyperplane for separation. However, the simplest form of hyperplane is a plane, that is, a linear function of the attributes. Fast to learn, impressively effective in Text Categorization in general, and in spam


77

classification in particular, SVMs represent one of the leading edges in learningbased spam filters. The linear function that can be obtained when using the SMO algorithm on our version of the SpamBase collection is: f ðmÞ ¼ ð 1:9999 w removeÞ þ ð0:0001 w yourÞ þ ð1:9992 w freeÞ þ ð1:9992 w moneyÞ þ ð2:0006 w hpÞ þ 0:9993 This function means that given a message m, in which the weights of the words are represented by ‘w_word,’ being 0 or 1, the message is classified as legitimate if replacing the weights in the functions leads to a positive number. So, negative factors like 1.9 (for ‘remove’) are spammy, and positive factors like 2.0 (for ‘hp’) are legitimate. Note that there is an independent term (0.9993) that makes a message without any of the considered words being classified as legitimate.

3.2.4.5 k-Nearest Neighbors.

Previous learning algorithms were based on building models about the categories used for classification. An alternative approach consists of storing training documents once they have been preprocessed and represented, and when a new instance has to be classified, it is compared to stored documents and assigned to the more appropriate category according to the similarity of the message to those in each category. This strategy does not build an explicit model of categories, but it generates a classifier know as ‘instance based,’ ‘memory based,’ or ‘lazy’ [68]. The most popular one is kNN [99]. The k parameter represents the number of neighbors used for classification. This algorithm does not have a training step and the way it works is very simple: 1. Get the k more similar documents in the training set. 2. Select the most often category in those k documents.

Obviously, a very important part of this algorithm is the function that computes similarity between documents. The most common formula to obtain the distance between two documents is the ‘cosine distance’ [82], which is the cosine of the angle between the vectors representing the messages that are being compared. This formula is very effective, as it normalizes the length of the documents or messages. In Fig. 6, we show a geometric representation of the operation of kNN. The document to be classified is represented by the letter D, and instances in the positive class (spam) are represented as X, while messages in the negative class are represented as O. In the left pane, we show the case of a linearly separable space. In that case, a linear classifier and a kNN classifier would give the same outcome (spam in this case). In the right pane, we can see a more mixed space, where kNN can show its

78

E.P. SANZ ET AL.

FIG. 6. Geometric representation of k-Nearest Neighbors (kNN) classifier. For making figure simpler, Euclidean distance has been used instead of ‘cosine distance.’

full power by selecting the locally most popular class (legitimate), instead of the one a linear classifier would learn (spam).

3.2.4.6 Classifier Committees. Another approach consists of applying different models to the same data, combining them to get better results. Bagging, boosting, and stacking are some of the techniques used to combine different learners. The concept of bagging (voting for classification, averaging for regression-type problems with continuous dependent variables of interest) combines the predicted classifications (prediction) from multiple models, or from the same type of model for different learning data. Note that some weighted combination of predictions (weighted vote, weighted average) is also possible, and commonly used. A sophisticated (Machine Learning) algorithm for generating weights for weighted prediction or voting is the boosting procedure. The concept of boosting (applied to spam detection in [14]) is used to generate multiple models or classifiers (for prediction or classification), and to derive weights to combine the predictions from those models into a single prediction or predicted classification. A simple algorithm for boosting works like this: Start by applying some method to the learning data, where each observation is assigned an equal weight. Compute the predicted classifications, and apply weights to the observations in the learning sample that are inversely proportional to the accuracy of the classification. In other words, assign greater weight to those observations that were difficult to classify (where the misclassification rate was high), and lower weights to those that were easy to classify (where the misclassification rate was low). Then apply the classifier again to the weighted data (or with different misclassification costs), and


79

continue with the next iteration (application of the analysis method for classification to the re-weighted data). If we apply boosting to the C4.5 learner, with 10 iterations, we obtain 10 decision trees with weights, which are applied to an incoming message. The first tree is that of Fig. 5, with weight 1.88, and the last tree has got only a test on the word ‘hp’: if it does not occur in the message, it is classified as spam, and as legitimate otherwise. The weight of this last tree is only 0.05. The concept of stacking (short for Stacked Generalization) [80] is used to combine the predictions from multiple models. It is particularly useful when the types of models included in the project are very different. Experience has shown that combining the predictions from multiple methods often yields more accurate predictions than can be derived from any one method [97]. In stacking, the predictions from different classifiers are used as input into a meta-learner, which attempts to combine the predictions to create a final best predicted classification.

3.2.4.7 Cost-Sensitive Learning.

When talking about spam filtering, we have to take into account that costs of misclassifications are not balanced in real life, as the penalty of a false positive (a legitimate message classified as spam) is much higher than the one of a false negative (a spam message classified as legitimate). This is due to the risk of missing important valid messages (like those from the users’ boss!) because messages considered spam can be immediately purged or, in a more conservative scenario, conserved in a quarantine that the user rarely screens. The algorithms commented above assume balanced misclassification costs by default, and it is wise to use techniques to make those algorithms cost-sensitive, in order to build more realistic filters [39]. Thresholding is one of the methods used for making algorithms cost-sensitive. Once a numeric-prediction classifier has been produced using a set of pre-classified instances (the training set), one can compute a numeric threshold that optimizes cost on another set of pre-classified instances (the validation set). When new instances are to be classified, the numeric threshold for each of them determines if the instances are classified as positive (spam) or negative (legitimate). The cost is computed in terms of a cost matrix that typically assigns 0 cost to the hits, a positive cost to false negatives, and a much bigger cost to false positives. This way, instead of optimizing the error or the accuracy, the classifier optimizes the cost. The weighting method consists of re-weighting training instances according to the total cost assigned to each class. This method is equivalent to stratification by oversampling as described in [29]. The main idea is to replicate instances of the most costly class, to force the Machine Learning algorithm to correctly classify that class

80

E.P. SANZ ET AL.

instances. Another effective cost-sensitive meta-learner is the MetaCost method [29], based on building an ensemble of classifiers using the bagging method, relabeling training instances according to cost distributions and the ensemble outcomes, and finally training a classier on the modified training collection. In [39], the experiments with a number of Machine Learning algorithms and the three previous cost-sensitive schemas have shown that the combination of weighting and SVM is the most effective one.

3.3

Filtering by Compression

Compression has recently emerged as a new paradigm for Text Classification in general [90], and for spam filtering in particular [11]. Compression demonstrates high performance in Text Categorization problems in which classification depends on nonword features of a document, such as punctuation, word stems, and features spanning more than one word, like dialect identification and authorship attribution. In the case of spam filtering, they have emerged as the top performers in competitive evaluations like TREC [19]. An important problem of Machine Learning algorithms is the dependence of the results obtained with respect to their parameter settings. In simple words, a big number of parameters can make it hard to find the optimal combination of them, that is, the one that leads to the most general and effective patterns. Keogh et al. discuss the need of a parameter-free algorithm: Data mining algorithms should have as few parameters as possible, ideally none. A parameter-free algorithm prevents us from imposing our prejudices and presumptions on the problem at hand, and let the data itself speak to us. [57] (p. 206)

Keogh presents data compression as a Data Mining paradigm that realizes this vision. Data compression can be used as an effective Machine Learning algorithm, especially on text classification tasks. The basic idea of using compression in a text classification task is to assign a text item to the class that best compresses it. This can be straightforwardly achieved by using any state-of-the-art compression algorithm and a command line process. As a result, the classification algorithm (the compression algorithm plus a decision rule) is easy to code, greatly efficient, and it does not need any preprocessing of the input texts. In other words, there is no need to represent it as a feature vector, avoiding one of the most difficult and challenging tasks, that is, text representation. As a side effect, this makes especially hard to reverse engineer the classification process, leading to more effective and stronger spam detection systems.


81

The rule of classifying a message into the class that best compresses it is a straightforward application of the Minimum Description Length Principle (MDL) [11] that favors the most compact (short) explanation of the data. The recent works by Sculley and Brodley [84] and by Bratko et al. [11] formalize this intuition in a different way; we will follow partially the work by Sculley and Brodley. Let C(.) be a compression algorithm. A compression algorithm is a function that transforms strings into (shorter) strings.21 A compression algorithm usually generates a (possibly implicit) model. Let C(X|Y) also be the compression of the string Y using the model generated by compressing the string X. We denote by |S| the length of a string S, typically measured as a number of bits, and by XY the string Y appended to the string X. The MDL principle states that, given a class A of text instances, a new text X should be assigned to A if it compresses X better than AC. If we interpret the class A as a sequence of texts (and so it is AC), the decision rule may be: classðXÞ ¼ arg min fjCðcjXÞjg c¼A;AC

This formula is one possible decision rule for transforming a compression algorithm into a classifier. The decision rule is based on the ‘approximate’ distance22 |C(A|X)|. Sculley and Brodley [84] review a number of metrics and measures that are beyond the scope of this presentation. The length of the text X compressed with the model obtained from a class A can be approached by compressing AX: jCðAjXÞj jCðAXÞj jCðAÞj This way, any standard compressor can be used to predict the class of a text X, given the classes A and AC. Following [11], there are two basic kinds of compressors: two part and adaptive coders. The first class of compressors first trains a model over the data to encode, and then encode the data. These require two passes over the data. These kinds of encoders append the data to the model, and the decoder reads the model and then decodes the data. The most classical example of this kind of compressors is a double pass Huffman coder, which accumulates the statistics for the observed symbols, builds a statistically optimal tree using a greedy algorithm, and builds a file with the tree and the encoded data. 21 This presentation can be made in terms of sequences of bits instead of strings as sequences of characters. 22 This is not a distance in the proper sense, as it does not satisfy all the formal requirements of a distance.

82

E.P. SANZ ET AL.

Adaptive compressors instead start with an empty model (e.g., a uniform distribution over all the symbols), and update it as they are encoding the data. The decoder repeats the process, building its own version of the model as the decoding progresses. Adaptive coders require a single pass over the data, so they are more efficient in terms of time. They have also reached the quality of two-part compressors in terms of compressing ratio, and more interestingly for our purposes, they make the previous approximation an equality. Examples of adaptive compressors include all of those used in our work, which we describe below. For instance, the Dynamic Markov Compression (DMC), the Prediction by Partial Matching (PPM), and the family of Lempel-Ziv (LZ) algorithms are all adaptive methods (see [11] and [84]). Let us get back to the parameter issue. Most compression algorithms do not require any preprocessing of the input data. This clearly avoids the steps of feature representation and selection usually taken when building a learning-based classifier. Also, most often compressors have a relatively small number of parameters, approaching the vision of a parameter-free or parameter-light Data Mining. However, a detailed analysis performed by Sculley and Brodley in [84] brings light to this point, as they may depend on explicit parameters in compression algorithms, the notion of distance used, and the implicit feature space defined by each algorithm. On the other hand, it is extremely easy to build a compression-based classifier by using the rules above and a standard out-of-the-shelf compressor, and they have proven to be effective on a number of tasks, and top-performer in spam filtering. In words by Cormack (one of the organizers of the reputed TREC spam Track competition) and Bratko: ‘‘At TREC 2005, arguably the best-performing system was based on adaptive data compression methods’’, and ‘‘one should not conclude, for example, that SVM and LR (Logistic Regression) are inferior for on-line filtering. One may conclude, on the other hand, that DMC and PPM set a new standard to beat on the most realistic corpus and test available at this time.’’ [21]

While other algorithms have been used in text classification, it appears that only DMC and PPM have been used in spam filtering. The Dynamic Markov Compression [11] algorithm models an information source with a finite state machine (FSM). It constructs two variable-order Markov models (one for spam and one for legitimate email), and classifies a message according to which of the models predicts it best. The Partial Prediction Matching algorithm is a back-off smoothing technique for finite-order Markov models, similar to back-off models used in natural language processing, and has set the standard for lossless text compression since its introduction over two decades ago according to [17]. The best of both is DMC, but PPM is better known and very competitive with it (and both superior to Machine Learning approaches at spam filtering). There are some efforts that also work at the character level (in combination with some ad hoc scoring function), but they are different


83

from compression as this has been principle designed to model sequential data. In particular, the IBM’s Chung-Kwei system [77] uses pattern matching techniques originally developed for DNA sequences, and the Pampapathi et al. [70] have proposed a filtering technique based on the suffix tree data structure. This reflects the trend of minimizing tokenization complexity in order to avoid one of the most relevant vulnerabilities of learning-based filters.

3.4

Comparison and Summary

Heuristic filtering relying on the manual effort of communities of experts has been quickly beaten by spammers, as they have stronger (economic) motivation and time. But automated with content-based methods, a new episode in the war against spam is being written. The impact of and success of content-based spam filtering using Machine Learning and compression is significant, as the spammers have invested much effort to avoid this kind of filtering, as we review below. The main strength of Machine Learning is that it makes the filter adapted to the actual users’ email. As every user is unique, every filter is different, and it is quite hard to avoid all vendors’ and users’ filters simultaneously. The processing structure of learning-based filters includes a tokenization step in which the system identifies individual features (typically strings of character, often meaningful words) on which the system relies to learn and classify. This step has been recognized as the major vulnerability of learning-based filtering, and the subject of most spammers’ attacks, in the form of tokenization attacks and image spam. The answer from the research community has been fast and effective, focusing on character-level modeling techniques based on compression, that detect implicit patterns that not even spammers know they are using! Compression-based methods have proven top effective in competitive evaluations, and in consequence, that can be presented as the current (successful) trend in content-based spam filtering.

4.

Spam Filters Evaluation

Classifier system evaluation is a critical point: no progress may be expected if there is no way to assess it. Standard metrics, collections, and procedures are required, which allow cross-comparison of research works. The Machine Learning community has well-established evaluation methods, but these have been adapted and improved when facing what is probably the main difficulty in spam filtering: the problem of asymmetric misclassification costs. The fact that a false positive

84

E.P. SANZ ET AL.

(a legitimate message classified as spam) is much more damaging than a false negative (a spam classified as legitimate) implies that evaluation metrics must attribute bigger weights to worse errors, but . . . which weights? We analyze this point in Section 4.3. Scientific evaluations have well-defined procedures, consolidated metrics, and public test collections that make cross-comparison of results relatively easy. The basis of scientific experiments is that they have to be reproducible. There are a number of industrial evaluations, performed by the filter vendors themselves and typically presented in their white papers, and more interestingly, those performed by specialized computer magazines. For instance, in [53], the antispam appliances BorderWare MXtreme MX-200 and Proofpoint P800 Message Protection Appliance are compared using an ad hoc list of criteria, including Manageability, Performance, Ease of Use, Setup, and Value. Or in [3], 10 systems are again tested according to a different set of criteria, allowing no possible comparison. The limitations of industrial evaluations include self-defined criteria, private test collections, and selfdefined performance metrics. In consequence, we focus on scientific evaluations in this chapter. The main issues in the evaluation of spam filters are the test collections, the running procedure, and the evaluation metrics. We discuss these issues in the next subsections, with special attention to what we consider a real and accurate standard in current spam filter evaluation, the TREC spam Track competition.

4.1

Test Collections

A test collection is a set of manually classified messages that are sent to a classifier in order to measure its effectiveness, in terms of hits and mistakes. It is important that test collections are publicly available, because it allows the comparison of approaches and the improvement of the technology. On the other hand, message collections may include private email, so privacy protection is an issue. There are a number of works in which the test collections employed are kept private, as they are personal emails from the author or are donated to them with the condition of being kept private, like in early works [30], [75], and [79], or even in more recent works like [36], [47], and [69]. The privacy problem can be solved in different ways: l

l

Serving a processed version of the messages that does not allow rebuilding them. This approach has been followed in the SpamBase, PU1, and the 2006 ECML-PKDD Discovery Challenge public collections. Building the collection using only messages from public sources. This is the approach in the Lingspam and SpamAssassin Public Corpus.

EMAIL SPAM FILTERING l

85

Keeping the collection private in the hands of a reputable institution that performs the testing on behalf of the researchers. The TREC spam Track competition is such an institution, and makes some test collections public, and keeps some others private.

In the next paragraphs, we present the test collections that have been publicly available, solving the privacy problem: l

l

l

SpamBase23 is an email message collection containing 4,601 messages, being 1,813 (39%) marked as spam. The collection comes in preprocessed (not raw) form, and its instances have been represented as 58-dimensional vectors. The first 48 features are words extracted from the original messages, without stop list or stemming, and selected as the most unbalanced words for the UCE class. The next 6 features are the percentage of occurrences of the special characters ‘;,’ ‘(,’ ‘[,’ ‘!,’ ‘$,’ and ‘#.’ The following 3 features represent different measures of occurrences of capital letters in the text of the messages. Finally, the last feature is the class label. This collection has been used in, for example, [34], and its main problem is that it is preprocessed, and in consequence, it is not possible to define and test other features apart from those already included. The PU1 corpus,24 presented in [6], consists of 1,099 messages, being 481 (43%) spam and 618 legitimate. Been received by Ion Androutsopoulos, it has been processed by removing attachments and HTML tags. To respect privacy issues, in the publicly available version of PU1, fields other than ‘Subject:’ have been removed, and each token (word, number, punctuation symbol, etc.) in the bodies or subjects of the messages was replaced by a unique number, the same number throughout all the messages. This hashing ‘encryption’ mechanism makes impossible to perform experiments with other tokenization techniques and features apart from those included by the authors. It has been used in, for example, [14] and [52]. The ECML-PKDD 2006 Discovery Challenge collection25 has been collected by the challenge organizers in order to test how to improve spam classification using untagged data [9]. It is available in a processed form: strings that occur fewer than four times in the corpus are eliminated, and each message is represented by a vector indicating the number of occurrences of each feature in the message. The same comments to PU1 are applicable to this collection.

23 This collection has been described above, but some information is repeated for the sake of comparison. 24 Available at: http://www.aueb.gr/users/ion/data/PU123ACorpora.tar.gz. 25 Available at: http://www.ecmlpkdd2006.org/challenge.html.

86 l

l

E.P. SANZ ET AL.

The Lingspam test collection,26 presented in [4] and used in many studies (including [14], [39], and very recent ones like [21]), has been built by mixing spam messages with messages extracted from spam-free public archives of mailing lists. In particular, the legitimate messages have been extracted from the Linguist list, a moderated (hence, spam-free) list about the profession and science of linguistics. The number of legitimate messages is 2,412, and the number of spam messages is 481 (16%). The Linguist messages are, of course, more topic-specific than most users’ incoming email. They are less standardized, and for instance, they contain job postings, software availability announcements, and even flame-like responses. In consequence, the conclusions obtained from experiments performed on it are limited. The SpamAssassin Public Corpus27 has been collected by Justin Mason (a SpamAssassin developer) with the public contributions of many others, and consists of 6,047 messages, being 1,897 (31%) spam. The legitimate messages (named ‘ham’ in this collection) have been further divided into easy and hard (the ones that make use of rich HTML, colored text, spam-like words, etc.). As it is relatively big, realistic, and public, it has become the standard in spam filter evaluation. Several works make use of it (including [11], [21], [22], and [67]), and it has been routinely used as a benchmark in the TREC spam Track [19].

Apart from these collections, the TREC spam Track features several public and private test collections, like the TREC Public Corpus – trec05p-1, and the Mr. X, S.B., and T.M. Private Corpora. For instance, the S.B. corpus consists of 7,006 messages (89% ham, 11% spam) received by an individual in 2005. The majority of all ham messages stems from four mailing lists (23%, 10%, 9%, and 6% of all ham messages) and private messages received from three frequent correspondents (7%, 3%, and 2%, respectively), while the vast majority of the spam messages (80%) are traditional spam: viruses, phishing, pornography, and Viagra ads. Most TREC collections have two very singular and interesting properties: 1. Messages are chronologically sorted, allowing testing the effect of incremental learning, what we mention below as online testing. 2. They have build by using an incremental procedure [20], in which messages are tagged using several antispam filters, and the classification is reviewed by hand when a filter disagrees. TREC collections are also very big in comparison with the previously described ones, letting the researchers arriving at more trustable conclusions. 26 27

Available at: http://www.aueb.gr/users/ion/data/lingspam_public.tar.gz. Available at: http://spamassassin.apache.org/publiccorpus/.


87

In other words, TREC spam Track has set the evaluation standard for antispam learning-based filters.

4.2

Running Test Procedure

The most frequent evaluation procedure for a spam filter is batch evaluation. The spam filter is trained on a set of messages, and applied to a different set of test messages. The test messages are labeled, and it is possible to compare the judgment of the filter and of the expert, computing hits and mistakes. It is essential that the test collection is similar to, but disjoint of, the training one, and that it reflects operational settings as close as possible. This is the test procedure employed in most evaluations using the SpamBase, PU1, and Linspam test collections. A refinement of this evaluation is to perform N-fold cross-validation. Instead of using a separate test collection, portions of the labeled collection are sometimes used as training and as test sets. In short, the labeled collection is randomly divided into N sets or folds (preserving the class distribution), and N tests are run, using N1 folds as training set, and the remaining one as test set. The results are averaged over the N runs, leading to more statistically valid figures, as the experiment does not depend on unpredictable features of the data (all of them are used for training and testing). This procedure has been sometimes followed in spam filtering evaluation, like in [39]. A major criticism to this approach is that the usual operation of spam filters allows them to learn from the mistakes they made (if the user reports them, of course). The batch evaluation does not allow the filters to learn as it classifies, and ignores chronological ordering if available. The TREC organizers have instead approached filter testing as an on-line learning task in which messages are presented to the filter, one at a time, in chronological order. For each message, the filter predicts its class (spam or legitimate) by computing a score S which is compared to a fixed but arbitrary threshold T. Immediately after the prediction, the true class is presented to the filter so that it might use this information in future predictions. This evaluation procedure is supported with a specific set of scripts, requiring a filter to implement the next command-line functions: l l

l

l

l

Initialize – creates any files or servers necessary for the operation of the filter. Classify message – returns ham/spam classification and spamminess score for message. Train ham message – informs filter of correct (ham or legitimate) classification for previously classified message. Train spam message – informs filter of correct (spam) classification for previously classified message. Finalize – removes any files or servers created by the filter.

88

E.P. SANZ ET AL.

This is the standard procedure used in TREC. An open question is if both methods are equivalent, in term of the results obtained in public works. Cormack and Bratko have made in [21] a systematic comparison of a number of top-performing algorithms following both procedures, and arriving at the conclusion that the current leaders are compression methods, and that the online procedure is more suitable because it is closer to operational settings.

4.3

Evaluation Metrics

We have divided the metrics used in spam filtering test studies into three groups: the basic metrics employed in the initial works, the ROCCH method as a quite advanced one that addresses prior errors, and the TREC metrics as the current standard.

4.3.1 Basic Metrics The effectiveness of spam filtering systems is measured in terms of the number of correct and incorrect decisions. Let us suppose that the filter classifies a given number of messages. We can summarize the relationship between the system classifications and the correct judgments in a confusion matrix, like that shown in Table II. Each entry in the table specifies the number of documents with the specified outcome. For the problem of filtering spam, we take spam as the positive class (+) and legitimate as the negative class (–). In this table, the key ‘tp’ means ‘number of true-positive decisions’ and ‘tn,’ ‘fp,’ and ‘fn’ refer to the number of ‘true-negative,’ ‘false-positive,’ and ‘false-negative’ decisions, respectively. Most traditional TC evaluation metrics can be defined in terms of the entries of the confusion matrix. F1 [85] is a measure that gives equal importance to recall and precision. Recall is defined as the proportion of class members assigned to a category by a classifier. Precision is defined as the proportion of correctly assigned

Table II A SET OF N CLASSIFICATION DECISIONS REPRESENTED AS A CONFUSION MATRIX

+

+ tp fn

fp tn


89

documents to a category. Given a confusion matrix like the one shown in the table, recall (R), precision (P), and F1 are computed using the following formulas: R¼

tp tp þ fn

R¼

tp tp þ fp

F1 ¼

2RP RþP

Recall and precision metrics have been used in some of the works in spam filtering (e.g., [4–6, 42, 80]). Other works make use of standard ML metrics, like accuracy and error [71, 75]. Recall that not all kinds of classification mistakes have the same importance for a final user. Intuitively, the error of classifying a legitimate message as spam (a false positive) is far more dangerous than classifying a spam message as legitimate (a false negative). This observation can be re-expressed as the cost of a false positive is greater than the cost of a false negative in the context of spam classification. Misclassification costs are usually represented as a cost matrix in which the entry C(A,B) means the cost of taking a A decision when the correct decision is B, that is the cost of A given B (cost(A|B)). For instance, C(+,–) is the cost of a false-positive decision (classifying legitimate email as spam) and C(–,+) is the cost of a false-negative decision. The situation of unequal misclassification costs has been observed in many other ML domains, like fraud and oil spills detection [74]. The metric used for evaluating classification systems must reflect the asymmetry of misclassification costs. In the area of spam filtering, several cost-sensitive metrics have been defined, including weighted accuracy (WA), weighted error (WE), and total cost ratio (TCR) (see e.g., [5]). Given a cost matrix, the cost ratio (CR) is defined as the cost of a false positive over the cost of a false negative. Given the confusion matrix for a classifier, the WA, WE, and TCR for the classifier are defined as: WA ¼

CR tn þ tp CRðtn þ fpÞ þ ðtp þ fnÞ

WE ¼

CR fp þ fn CRðtn þ fpÞ þ ðtp þ fnÞ

TCR ¼

tn þ fp CR fp þ fn

90

E.P. SANZ ET AL.

The WA and WE metrics are versions of the standard accuracy and error measures that penalize those mistakes that are not preferred. Taking the trivial rejecter that classifies every message as legitimate (equivalent to not using a filter) as a baseline, the TCR of a classifier represents to what extent is a classifier better than it. These metrics are less standard than others used in cost-sensitive classification, as Expected Cost, but to some extent they are equivalent. These metrics have been calculated for a variety of classifiers, in three scenarios corresponding to three CR values (1, 9, and 999) [4–6, 42, 80]. The main problem presented in the literature on spam cost-sensitive categorization is that the CR used does not correspond to real world conditions, which are unknown and may be highly variable. There is no evidence that a false positive is neither 9 nor 999 times worse than the opposite mistake. As class distributions, CR values may vary from user to user, from corporation to corporation, and from ISP to ISP. The evaluation methodology must take this fact into account. Fortunately, there are methods that allow evaluating classifiers effectiveness when target (class distribution and CR) conditions are not known, as in spam filtering. In the next subsection, we introduce the ROCCH method for spam filtering.

4.3.2 The ROCCH Method The receiver operating characteristics (ROC) analysis is a method for evaluating and comparing a classifiers performance. It has been extensively used in signal detection, and introduced and extended by Provost and Fawcett in the Machine Learning community (see e.g., [74]). In ROC analysis, instead of a single value of accuracy, a pair of values is recorded for different class and cost conditions a classifier is learned. The values recorded are the false-positive (FP) rate and the true-positive (TP) rate, defined in terms of the confusion matrix as: FP ¼

fp fp þ tn

TP ¼

tp tp þ fn

The TP rate is equivalent to the recall of the positive class, while the FP rate is equivalent to 1 less than the recall of the negative class. Each (FP,TP) pair is plotted as a point in the ROC space. Most ML algorithms produce different classifiers in different class and cost conditions. For these algorithms, the conditions are varied to obtain a ROC curve. We will discuss how to get ROC curves by using methods for making ML algorithms cost-sensitive.

91


One point on a ROC diagram dominates another if it is above and to the left, that is, has a higher TP and a lower FP. Dominance implies superior performance for a variety of common performance measures, including expected cost (and then WA and WE), recall, and others. Given a set of ROC curves for several ML algorithms, the one which is closer to the left upper corner of the ROC space represents the best algorithm. Dominance is rarely got when comparing ROC curves. Instead, it is possible to compute a range of conditions in which one ML algorithm will produce at least better results than the other algorithms. This is done through the ROC convex hull (ROCCH) method, first presented in [74]. Concisely, given a set of (FP,TP) points, that do not lie on the upper convex hull, corresponds to suboptimal classifiers for any class and cost conditions. In consequence, given a ROC curve, only its upper convex hull can be optimal, and the rest of its points can be discarded. Also, for a set of ROC curves, only the fraction of each one that lies on the upper convex hull of them is retained, leading to a slope range in which the ML algorithm corresponding to the curve produces best performance classifiers. An example of ROC curves taken from [39] is presented in Fig. 7. As it can be seen, there is no single dominator. The ROC analysis allows a visual comparison of the performance of a set of ML algorithms, regardless of the class and cost conditions. This way, the decision of which is the best classifier or ML algorithm can be delayed until target (real world) conditions are known, and valuable information can be obtained at the same time. In the most advantageous case, one algorithm is dominant over the entire slope range.

1.0

0.9 0.0

0.1 C4.5 SVM

0.1

0.2 NB Roc

FIG. 7. A ROC curve example.

0.2 PART CH

92

E.P. SANZ ET AL.

Usually, several ML algorithms will lead to classifiers that are optimal (among those tested) for different slope ranges, corresponding to different class and cost conditions. Operatively, the ROCCH method consists of the following steps: 1. For each ML algorithm, obtain a ROC curve and plot it (or only its convex hull) on the ROC space. 2. Find the convex hull of the set of ROC curves previously plotted. 3. Find the range of slopes for which each ROC curve lies on the convex hull. 4. In case the target conditions are known, compute the corresponding slope value and output the best algorithm. In other case, output all ranges and best local algorithms or classifiers. We have made use of the ROCCH method for evaluating a variety of ML algorithms for the problem of spam filtering in [39]. This is the very first time that ROC curves have been used in spam filtering testing, but they have become a standard in TREC evaluations.

4.3.3 TREC Metrics TREC Spam Track metrics [19] are considered also a standard in terms of spam filtering evaluation. The main improvement over the ROC method discussed above is their adaptation to the online procedure evaluation. As online evaluation allows a filter to learn from immediately classified errors, its (TP,FP) rate is always changing and the values improving with time. The ROC graph is transformed into a single numeric figure, by computing the Area Under the ROC curve (AUC). As the evaluated filters are extremely effective, it is better to report the inverse 1AUC value, which is computed over time as the learningtesting online process is active. This way, it is possible to get an idea of how quickly the systems learn, and at which levels of error the performance arrives a plateau. In Fig. 8, a ROC Learning Curve graph is also shown, taken from [19] for Mr. X text collection. It is easy to see how filters start committing a relatively high number of mistakes at the beginning of the ROC Learning Curve, and they improve their result finally achieving an average performance level.

5.

Spam Filters in Practice

Implementing effective and efficient spam filters is a nontrivial work. Depending on concrete needs, it should be implemented in a certain way and the management of spam messages can vary depending on daily amount of messages, the estimated impact of possible false positives, and other peculiarities of users and companies.

93

EMAIL SPAM FILTERING ROC learning curve 621SPAM1mrx kidSPAM1mrx tamSPAM1mrx lbSPAM2mrx ijSPAM2mrx yorSPAM2mrx crmSPAM2mrx

(1-ROCA)% (logit scale)

50.00

10.00

1.00

0.10

0.01

0

5000

10,000 15,000 20,000 25,000 30,000 35,000 40,000 45,000 50,000

Messages FIG. 8. A ROC learning curve from TREC.

Figure 9 shows a diagram of the mail transportation process, where spam filters can be implemented at any location in this process, although the most common and logical ones are in the receiver’s SMTP Server/Mail Delivery Agent (server side) or in the receiver’s email client (client side). There are also some enterprise solutions that perform the spam filtering in external servers, which is not reflected in this diagram as not being usual at the current moment. There are important questions that we cannot obviate and we need to test carefully for their response before implementing or implanting a spam filter solution. Should we implement our spam filter in the client side or in the server side? Should we use any kind of collaborative filtering? Should the server delete the spam messages or the user should decide what to do with those undesirable messages?

5.1

Server Side Versus Client Side Filtering

The first important choice when implementing or integrating a spam filter in our IT infrastructure is the location of the filter: in the client side or in the server side. Each location has its own benefits and disadvantages and those must be measured to choose the right location depending on the user/corporation concrete needs.

94

E.P. SANZ ET AL.

Sender’s email client

Sender’s SMTP server

Receiver’s SMTP client Server side filtering Mail delivery agent

Receiver’s POP server

Receivers’s email client

Client side filtering

FIG. 9. Email transport process and typical location of server and client side filters. Filters can, virtually, be implemented in any step of the process.

The main features of server side spam filters are: l

l

l

They reduce the network load, as the server does not send the mails categorized as spam, which can be the biggest part of the received messages. They also reduce the computational load on the client side, as the mail client does not need to check each received message. This can be very helpful when most clients have a low load capacity (handhelds, mobile phones, etc.). They allow certain kinds of collaborative filtering or a better integration of different antispam techniques. For example, when detecting spam messages received in different users’ account from the same IP, this can be added to a black list preventing other users to receive messages from the same spammer.

On the other side, client side spam filters: l l

l

Allow a more personalized detection of management of the messages. Integrate the knowledge from several email accounts belonging to the same user, preventing the user to receive the same spam in different email accounts. Reduce the need of dedicated mail servers as the computation is distributed among all the users’ computers.


95

As corporations and other organizations grow, their communications also need to grow and they increasingly rely on dedicated servers and appliances that are responsible for email services, including the email server, and the full email security suite of services, including the antivirus and antispam solutions. Appliances and dedicated servers are the choice for medium to big corporations, while small organizations and individual users can group the whole Internet services in one machine. In big corporations, each Internet-related service has its own machine, as the computational requirements deserve special equipment, and it is a nice idea to distribute the services in order to minimize risks.

5.2

Quarantines

Using statistical techniques is really simple to detect almost all the received spam but a really difficult, almost impossible, point is to have a 0 false-positive ratio. As common bureaucratic processes and communication are delegated to be conducted via email, false positives are being converted into a really annoying question; losing only one important mail can have important economic consequences or, even, produce a delay in some important process. On the other hand as each user is different, what should be done with a spam message should be left to the user’s choice. A clocks lover user would conserve Rolex-related spam. A key point here is that spam is sent because the messages sent are of interest to a certain set of users. These points are difficult to solve with server spam filter solution as the spam filter is not as personalized as a spam filter implemented on the client side. Quarantine is a strategy developed to face these points. The messages detected as spam by the spam filter are stored in the server for a short period of time and the server mails a Quarantine Digest to the user reporting all the messages under quarantine. The user is given the choice of preserving those messages or deleting them. Quarantine is a helpful technique that allows to: l l l l

Reduce the disk space and resources the spam is using on the mail servers. Reduce the user’s level of frustration when they receive spam. Keeps spam from getting into mailing lists. Prevent auto replies (vacation, out of office, etc.) from going back to the spammers.

In Fig. 10, we show an example of quarantine, in the Trend Micro InterScan Messaging Security Suite, a solution that includes antivirus and antispam features, and that is designed for serve side filtering. The quarantine is accessed by actual

96

E.P. SANZ ET AL.

FIG. 10. An example of list of messages in the Trend Micro InterScan Messaging Security Suite.

users through a web application, where they log and screen the messages that the filter has considered spam. This quarantine in particular features the access to a white list of approved senders, a white list where the user can type in patterns that make the filter ignore messages, like those coming from the users’ organization.

5.3

Proxying and Tagging

There are a number of email clients that currently implement their own contentbased filters, most often based on the Graham’s Bayesian algorithm. For instance, the popular open-source Mozilla Thunderbird client includes a filter that is able to learn from the users’ actual email, leading to better personalization and increased effectiveness. However, there are a number of email clients that do not feature an antispam filter at all. Although there are a number of extensions or plugins for popular email clients (like the ThunderBayes extension for Thunderbird, or the SpamBayes Microsoft


97

Outlook plugin – both including the SpamBayes filter controls into the email clients), the user may wish to keep the antispam software out of the email client, in order to change any of them if a better product is found. There are a number of spam filters that run as POP/SMTP/Imap proxy servers. These products download the email on behalf of the user, analyze it deciding if it is spam or legitimate, and tag it accordingly. Example of these products are POPFile (that features general email classification, apart from spam filtering), SpamBayes (proxy version), K9, or SAwin32 (Fig. 11). As an example, the program SAwin32 is a POP proxy that includes a fully functional port of SpamAssassin for Microsoft Windows PCs. The proxy is configured to access the POP email server from where the user downloads his email and to check it using the SpamAssassin list, rule, and Bayesian filters. If found to be spam, a message is tagged with a configurable string in the subject (e.g., the default is ‘*** SPAM ***’) and the message is forwarded to the user with an explanation in the body and the original message as an attachment. The explanation presents a digest of the message, and describes the tests that have been fired by the message, the spam

FIG. 11. An example of message scanned by the SAwin32 proxy, implementing the full set of tests and techniques of SpamAssassin.

98

E.P. SANZ ET AL.

score of the message, and other administrative data. The proxy also adds some nonstandard headers, beginning with ‘X-,’28 like ‘X-Spam-Status,’ that includes the spam value of the message (‘Yes’ in this case), and the tests and scores obtained. The user can then configure a filter in his email client, sending to a spam box (a local quarantine) all the messages that arrive tagged as spam. The user can also suppress the additional tag and rely on the spam filter headers. Also, most proxy-type filters also include the possibility of not downloading the messages tagged as spam to the email client, and keeping a separate quarantine in the proxy program, many often accessed as a local web application. The tagging approach can also work at the organization level. The general email server tags the messages for all users, but each one prepares a local filter based on the server-side tags if that is needed.

5.4

Best and Future Practical Spam Filtering

As stated in [27], ‘the best results in spam filtering could be achieved by a combination of methods: Black lists stop known spammers, graylists eliminate spam sent by spam bots, decoy email boxes alert to new spam attacks, and Bayesian filters detect spam and virus attack emails right from the start, even before the black list is updated.’ False positives are still a problem due to the important effects that loosing an important mail can produce, along with the bouncing emails created by viruses [8], an important new kind of spam. Probably, in the future, all these techniques will be mixed with economic and legal antispam measures like computing time-based systems,29 money-based systems [53], strong antispam laws [15], and other high-impact social measures [80]. Each day, the filters apply more and more measures to detect spam due to its high economic impact.

6.

Attacking Spam Filters 6.1

Introduction

As the volume of bulk spam email increases, it becomes more and more important to apply techniques that alleviate the cost that spam implies. Spam filters evolve to better recognize spam and that has forced the spammers to find 28 Non-standard headers in emails begin with ‘X-.’ In particular, our example includes some Mozilla Thunderbird headers, like ‘X-Mozilla-Status.’ 29 See, for instance, the HashCash service: http://www.hashcash.org.


99

new ways to avoid the detection of their spam, ensuring the delivery of their messages. For example, as statistical spam filters began to learn that words like ‘Viagra’ mostly occur in spam, spammers began to obfuscate them with spaces and other symbols in order to transform spam-related words in others like ‘V-i-ag-r-a’ that, while conserving all the meaning for a human being, are hardly detected by software programs. We refer to all the techniques that try to mislead the spam filters as attacks, and the spammers employing all these methods as attackers, since their goal is to mislead the normal behavior of the spam filter, allowing a spam message to be delivered as a normal message. A good spam filter would be most robust to past, present, and future attacks, but most empirical evaluations of spam filters ignore this because the spammers’ behavior is unpredictable and then, the real effectiveness of a filter cannot be known until its final release. The attacker’s point of view is of vital importance when dealing with spam filters because it gives full knowledge about the possible attacks to spam filters. This perspective also gives a schema of the way of thinking of spammers, which allows predicting possible attacks and to detect tendencies that can help to construct a robust and safe filter. Following this trend, there exist some attempts to compile spammers’ attacks as the Graham Cumming’s Spammer’s Compendium [42]. Usually, a spam filter is part of a corporate complex IT architecture, and attackers are capable to deal with all the parts of that architecture, exploiting all the possible weak points. Attending to this, there exist direct attacks that try to exploit the spam filter vulnerabilities and indirect attacks that try to exploit other weak points of the infrastructure. Indirect attacks’ relevance has been growing since 2004 as spammers shifted their attacks away from content and focuses more on the SMTP connection point [75]. Spammers usually make use of other security-related problems like virus and trojans in order to increase their infrastructure. Nowadays, a spammer uses trojan programs to control a lot of zombie-machines from which he is able to attack many sites while not being easily located as he is far from the origin of the attacks. That makes it more and more difficult to counteract the spammers’ attacks and increases the side effects of the attacks.

6.2

Indirect Attacks

Mail servers automatically send mails when certain delivery problems, such as a mail over-quota problem, occur. These automatically sent emails are called bounce messages. These bounce messages can be seen, in a way, as auto replies (like the out of office auto replies) but are not sent by human decisions, and in fact are sent

100

E.P. SANZ ET AL.

automatically by the mail server. All these auto replies are discussed in the RFC383430 that points out that it must be sent to the Return-Path established in the received email that has caused this auto reply. The return message must be sent without Return-Path in order to avoid an infinite loop of auto replies. From these bounce messages, there exist two important ones: the NDRs (NonDelivery Reports), which are a basic function of SMTP and inform that a certain message could not be delivered and the DSNs (Delivery Status Notifications) that can be explicitly required by means of the ESMTP (SMTP Service Extension) protocol. The NDRs implement part of the SMTP protocol that appears on the RFC282131: ‘If an SMTP server has accepted the task of relaying the mail and later finds that the destination is incorrect or that the mail cannot be delivered for some other reason, then it must construct an ‘‘undeliverable mail’’ notification message and send it to the originator of the undeliverable mail (as indicated by the reverse-path).’ The main goal of a spammer is to achieve the correct delivery of a certain nondesired mail. To achieve this goal, some time is needed to achieve a previous target. Indirect attacks are those that use characteristics outside the spam filter in order to achieve a previous target (like obtain valid email addresses) or that camouflages a certain spam mail as being a mail server notification. These indirect attacks use the bounce messages that the mail servers send in order to achieve their goals. Three typical indirect attacks are: 1. NDR (Non-Delivery Report) Attack 2. Reverse NDR Attack 3. Directory Harvest Attack The NDR Attack consists of camouflaging the spam in an email that appears to be a NDR in order to confuse the user who can believe that he sent the initial mail that could not be delivered. The curiosity of the user may drive him to open the mail and the attachment where the spam resides. The NDR Attacks have two weak points: 1. Make intensive use of the attacker’s mail server trying to send thousands or millions of NDR like messages that many times are not even opened by the recipient. 2. If the receiver’s mail server uses a black list where the attacker’s mail server’s IP is listed, the false NDR would not ever reach their destination. Then, all the efforts made by the spammer would not be useful at all.

30 31

Available at: http://www.rfc-editor.org/rfc/rfc3834.txt. Available at: http://www.ietf.org/rfc/rfc2821.txt.


101

To defeat these two weak points, the Reverse NDR Attack was devised. In a Reverse NDR Attack, the intended target’s email is used as the sender, rather than the recipient. The recipient is a fictitious email address that uses the domain name for the target’s company (for instance, ‘example.com’), such as noexist@example. com. The mail server of Example Company cannot deliver the message and sends an NDR mail back to the sender (which is the target email). This return mail carries the NDR and the original spam message attached and the target can read the NDR and the included spam thinking they may have sent the email. As can be seen in this procedure, a reliable mail server that is not in any black list and cannot be easily filtered sends the NDR mail. Another attack that exploits the bounce messages is the DHA (Directory Harvest Attack) which is a technique used by spammers attempting to find valid email addresses at a certain domain. The success of a Directory Harvest Attack relies on the recipient email server rejecting email sent to invalid recipient email addresses during the Simple Mail Protocol (SMTP) session. Any addresses to which email is accepted are considered valid and are added to the spammer’s list. There are two main techniques for generating the addresses that a DHA will target. In the first one, the spammer creates a list of all possible combinations of letters and numbers up to a maximum length and then appends the domain name. This is a standard brute force attack and implies a lot of workload in both servers. The other technique is a standard dictionary attack and is based on the creation of a list combining common first names, surnames, and initials. This second technique usually works well in company domains where the employees email addresses are usually created using their real names and surnames and not nicknames like in free mail services like Hotmail or Gmail.

6.3

Direct Attacks

The first generation of spam filters used rules to recognize specific spam features (like the presence of the word ‘Viagra’) [46]. Nowadays, as spam evolves quickly, it is impossible to update the rules as fast as new spam variations are created, and a new generation of more adaptable, learning-based spam filters has been created [46]. Direct attacks are attacks to the heart of those statistical spam filters and try to transform a given spam message into a stealthy one. The effectiveness of the attacks relies heavily on the filter type, configuration, and the previous training (mails received and set by the user as spam). One of the simplest attacks is called picospam and consists of appending random words to a short spam message, trying that those random words would be recognized as ‘good words’ by the spam filter. This attack is

102

E.P. SANZ ET AL.

very simple and was previously seen to be ineffective [63] but shows the general spirit of a direct attack to a spam filter. There are many spammer techniques [25, 91], which can be grouped into four main categories [96]: l

l

l

l

Tokenization: The attacks using tokenization work against the feature selection used by the filter to extract the main features from the messages. Examples of tokenization attacks include splitting up words with spaces, dashes, and asterisks, or using HTML, JavaScript, or CSS tricks. Obfuscation: With this kind of attacks, the message’s contents are obscured from the filter using different kinds of encodings, including HTML entity or URL encoding, letter substitution, Base64 printable encoding, and others. Statistical: These methods try to skew the message’s statistics by adding more good tokens or using fewer bad ones. There exist some variations of this kind of attacks depending on the methods used to select the used words. Weak statistical or passive attacks, that use random words and strong statistical or active attacks, which carefully select the words that are needed to mislead the filter by means of some kind of feedback. Strong statistical attacks are more refined versions of weak attacks, being more difficult to develop and their practical applicability can be questioned. Hiding the text: Some attacks try to avoid the use of words and inserts the spam messages as images, Flash, RTF, or in other file format; some other attacks insert a link to a web page where the real spam message resides. The goal is that the user could see the message but the filter could not extract any relevant feature.

We discuss instances of these attacks in the next sections.

6.3.1 Tokenization Attacks The statistical spam filters need a previous tokenization stage where the original message is transformed into a set of features describing the main characteristics of the email. A typical tokenization would count the occurrence of the words appearing in the email and would decompose the words by locating the spaces and other punctuation signals that separate the words. Tokenization attacks are conceived to attack this part of the filter, trying to avoid the correct recognition of spammy words by means of inserting spaces or other typical word delimiters inside the words. A typical example for avoiding the recognition of the word ‘VIAGRA’ would be separating the letters in this way ‘V-I.A:G-R_A.’ The user would easily recognize the word ‘VIAGRA’ but many filters would tokenize the word into multiple letters that do not represent the real content of the email.


103

6.3.1.1 Hypertextus Interruptus. The tokenization attack is based on the idea of splitting the words using HTML comments, pairs of zero width tags, or bogus tags. As the mail client renders the HTML, the user would see the message as if not containing any tag or comment, but the spam filters usually separates the words according to the presence of certain tags. Some examples trying to avoid the detection of the word ‘VIAGRA’: l l l l l

VIA GRA VIAGRA VIAG<xyz>R<xyz>A VxyzIAGRA VIAGRA

A typical tokenizer would decompose each of the last lines into a different set of words: l l l l l

VIA, GRA VI, AGRA VIAG, R, A V, IAGRA VIAGR, A

This makes more difficult to learn to distinguish the VIAGRA-related spam as each of the spam messages received contains a different set of features. The only way to face this kind of attacks is to parse carefully the messages trying to avoid HTML comments or extracting the features from the output produced by an HTML rendering engine.

6.3.1.2 Slice and Dice. Slice and Dice means to break a certain body of information down into smaller parts and then examine it from different viewpoints. Applied to spam attacks, slice and dice consists of dividing a spam message into text columns and then rewrite the message putting each text column in a column inside an HTML table. Applying the typical VIAGRA example, we could render it using a table as follows:
V I A G R A

The user would see only VIAGRA but the tokenizer would extract one feature by each different letter in the message.

104

E.P. SANZ ET AL.

6.3.1.3

Lost in Space. This is the most basic tokenization attack, and consists of adding spaces or other characters between the letters that composes a word in order to make them unrecognizable to word parsers. ‘V*I*A*G*R*A,’ ‘V I A G R A,’ and ‘V.I.A.G.R.A’ are typical examples applying this simple and common technique. Some spam filters recognize the words by merging nonsense words separated by common characters and studying if they compose a word that could be considered as a spam feature.

6.3.2 Obfuscation Attacks In obfuscation attacks, the message’s contents are obscured to the filter using different encodings or misdirection like letter substitution, HTML entities, etc. The way these attacks affect the spam filter is very similar to the way tokenization attacks affect. The features extracted from an obfuscation attack do not correspond with the standard features of the spam previously received. Obfuscating a word like ‘VIAGRA’ can be done in many ways: l l l

‘V1AGRA’ ‘VI4GR4’ `’ ‘VIÁGRA

All the previous ways to obfuscate the word ‘VIAGRA’ produce a different feature that would be used by the spam filter to distinguish or learn how to distinguish a spam message related to the VIAGRA. A prominent form of obfuscation is the utilization of leetspeak. Leetspeak or leet (usually written as l33t or 1337) is an argot used primarily on the Internet, but becoming very common in many online video games due to the excellent reception of this argot from the youngsters who use to obfuscate their mails or SMS trying to avoid their parents to understand what they write to other friends. The leet speech uses various combinations of alphanumeric characters to replace proper letters. Typical replacements are ‘4’ for ‘A,’ ‘8’ or ‘13’ for ‘B,’ ‘(’ for ‘C,’ ‘)’ or ‘|)’ for ‘D,’ ‘3’ for ‘E,’ ‘ph’ for ‘F,’ ‘6’ for ‘G,’ ‘#’ for ‘H,’ ‘1’ or ‘!’ for ‘I,’ etc. Using these replacements, ‘VIAGRA’ could be written as ‘V14GR4’ or ‘V!4G2A,’ which can be understood by a human being but would be intelligible by a spam filter. Foreign accent is an attack very similar to the leetspeak, but do not replace letters with alphanumeric characters, it uses accented letters to substitute vocals or even characters like ‘ç’ to substitute ‘c’ due to their similarity. ‘VIAGRA’ could be ´ GRA ´ ,’ ‘VIÀ ` GRA ` ,’ ‘VIÄGRA ¨ ,’ etc. rewritten in huge set of ways like ‘VIÁ The simplest way to affront these attacks is to undo these replacements, which can be very simple in the foreign accent attacks because there exists a univocal


105

correspondence between an accented letter and the unaccented letter. But the leetspeak is more difficult to translate as when a certain number or character is found, it would be needed to study whether the alphanumeric is representing a certain letter or it must continue being an alphanumeric.

6.3.3 Statistical Attacks While tokenization and obfuscation attacks are more related with the preprocessing stage of a spam filter, the statistical attacks have the main goal of attacking the heart of the statistical filter. Statistical attacks, more often called Bayesian poisoning [27, 37, 88] as most of the classifiers used to detect spam are Bayesian or Good Word Attacks [63], are based on adding random, or even carefully selected, words that are unlikely to appear in spam messages and are supposed to cause the spam filter to believe the message is not a spam (a statistical type II error). The statistical attacks have a secondary effect, a higher false-positive rate (statistical I error) because when the user trains their spam filter with spam messages containing normal words, the filter learns that these normal words are a good indication of spam. Statistical attacks are very similar, and what most vary among them is the way the words are added into the normal message and the way the words are selected. According to the word selection, there exist active attacks and passive attacks. According to the way the words are inserted in the email, there exist some variations like Invisible Ink and MIME-based attacks. Attacks can combine approaches, and for each possible variation of including the words in the message, the attack can be active or passive.

6.3.3.1 Passive Attacks. In passive attacks, the attacker constructs the word list to be used as the good words to be added in the spam messages without any feedback from the spam filter. Calburn [16] explains this process as ‘The automata will just keep selecting random words from the legit dictionary . . . When it reaches a Bayesian filtering system, [the filtering system] looks at these legitimate words and the probability that these words are associated with a spam message is really low. And the program will classify this as legitimate mail.’ The simplest passive attack consists of selecting a random set of words that would be added to all the spam messages sent by the attacker. If the same words are added to all the spam messages sent, that set of words would finish being considered as a good indicative of a spam message and the attack would convert into unproductive. Another simple yet more effective attack consists of a random selection of words per each spam mail sent or for each certain number of spam messages sent. Wittel [96] shows that the addition of random words was ineffective against the filter CRM-114 but effective against SpamBayes.

106

E.P. SANZ ET AL.

A smarter attack can be achieved by selecting common or hammy words instead of performing a random selection. Wittel [96] shows that attacks using common words are more effective against SpamBayes even when adding fewer words than when the word selection was randomizing. Instead, the work in [88] shows that by adding common words, the filter’s precision decreases from 84% to 67% and from 94% to 84% and proposes to ignore common words when performing the spam classification to avoid this performance falling.

6.3.3.2

Active Attacks. In active attacks, the attacker is allowed to receive some kind of feedback to know whether the spam filter labels a message as spam or not. Graham-Cumming [43] presents a simple way of getting this feedback by including a unique web bug at each message sent. A web bug is a graphic on a web page or inside an email that is designed to monitor who is reading a certain web or mail by counting the hits or accesses to this graphic. Having one web bug per word or per each word set allows the spammer to control what are the words that makes a spam message to look like a ham message to a certain spam filter. Lowd [63] shows that passive attacks adding random words to spam messages is ineffective as a form of attacks and also demonstrates that adding hammy words was very effective against naı¨ve Bayesian filters. Lowd [63] also shows in detail two active attacks that are very effective against most typical spam filters. The best way of preventing active attacks is to close any door that allows the spammer to receive any feedback from our system such as nondelivery reports, SMTP level errors, or web bugs.

6.3.3.3

Invisible Ink. This statistical attack consists of the addition of some real random words in the message but not letting the user to see those words. There are some variants of doing this: l l l

Add the random words before the HTML. Add an email header packer with the random words. Write a colored text on a background of the same color.

For avoiding this spammer practice, spam filters should work only with the data the user can see, avoiding headers and colored text over the same color background (Fig. 12).

6.3.4 Hidden Text Attacks These kind of attacks try to show the user a certain spam message but avoiding the spam filter to capture any feature from the content. The important point here is to place the spam message inside an image or other format, as RTF or PDF, that the


107

FIG. 12. An example of image-based spam.

email client will show to the user embedded into the message. We describe several kinds of attacks that try to avoid using text, or disguise it in formats hard to process effectively and efficiently.

6.3.4.1 MIME Encoding.

MIME (Multipurpose Internet Mail Extensions) is an Internet standard that allows the email to support plain text, non-text attachments, multi-part bodies, and non-ASCII header information. In this attack, the spammer sends a MIME document with the spam message in the HTML section and any normal text in the plain text section, which makes more difficult the work of the spam filter.

6.3.4.2 Script Hides the Contents.

Most email clients parse the HTML to extract the features and avoid the information inside SCRIPT tags as they usually contain no important information when we are extracting features to detect spam contents. Recently, some attackers have made use of script languages to change the contents of the message on mouse-over event or when the email is opened. Using this technique, the spam filter would read a normal mail that would be converted into a spam mail when opened by the email client.

6.3.4.3 Image-Based Spam.

The first image-based spam was reported by Graham-Cumming in 2003 and was very simple; it included only an image with the spam text inside. At that time images were loaded from Web sites using simple HTML image tags, but as email clients started to avoid the remote image load, spammers started to send the images as MIME attachments. First attempts to detect this kind of spam made the developers to use OCR (Optical Character Recognition) techniques to pull words out of the images and use them as features to classify the message as spam or ham.

108

E.P. SANZ ET AL.

But OCR is computationally expensive; its accuracy leaves much to be desired and can be easily mislead by adding noise to the images or even obfuscating the contents with the same techniques used to obfuscate the text content in text spam. According to IronPort statistics [49], 1% of spam was image based in June 2005 and one year later, it had risen to 16%. Cosoi [23] shows that the evolution of imagebased spam was from 5% by March 2006 to almost 40% at the end of 2006. Samosseiko [83] asserts that more than the 40% of the spam seen in SophosLabs at the end of 2006 is image-based spam. All these numbers show the real importance of image-based spam in the present spam’s world (Fig. 13). For a more detailed review of actual image-based techniques, Cumming [45] shows the evolution of image spam along the last years, from single images containing the whole spam, combinations (more or less complicated) of different images to show the spam to the user, integrating images with tokenization and obfuscation attacks, using strange fonts, adding random pixels to avoid OCR, hashing, etc. Interestingly, a number of researchers have devised approaches to deal with specific form of image spam. In particular, Biggio and others [10] have proposed to detect spam email by using the fact that spammers try to add noise to images in order to avoid OCRs, what it is called ‘obscuring’ by the authors. Also, and in a more general approach, Byun and others make use of a suite of synthesized attributes of

FIG. 13. An example of image-based spam with noise in order to avoid text recognition using OCR software.


109

spam images (color moment, color heterogeneity, conspicuousness, and selfsimilarity) in order to characterize a variety of image spam types [12]. These are promising lines of research, and combined with other techniques offer the possibility of high accuracy filtering.

6.3.4.4 Spam Using Other Formats.

As spam filter developers increase the precision of their software, spammers develop new variation of their attacks. One simple variation of image-based attacks consists of using a compressed PDF instead of an image to place the spam content trying to avoid the OCR scanning as PDF do not use to contain spam. Another attack consists of embedding RTF files, containing the spam message, which are sniffed by Microsoft email clients.

7.

Conclusions and Future Trends

Spam is an ever growing menace that can be very harmful. Its effects could be very similar to those produced by a Denial of Service Attack (DoS). Political, economical, legal, and technical measures are not enough to end the problem, and only a combination of all of them can lower the harm produced by it. Among all those approaches, content-based filters have been the best solution, having big impact in spammers that have had to search new ways to pass those filters. Luckily, systems based on Machine Learning algorithms allow the system to learn adapt to new treats, reacting to countermeasures used by spammers. Recent competitions in spam filtering have shown that actual systems can filter out most of the spam, and new approaches like those based on compression can achieve high accuracy ratios. Spammers have designed new and refined attacks that hit one of the critical steps in every learning method: the tokenization process, but compression-based filters have been very resistant to this kind of attack. References [1] Abadi M., Birrell A., Burrows M., Dabek F., and Wobber T., December 2003. Bankable postage for network services. In Proceedings of the 8th Asian Computing Science Conference, Mumbai, India. [2] Ahn L. V., Blum M., and Langford J., February 2004. How lazy cryptographers do AI. Communications of the ACM. [3] Anderson R., 2004. Taking a bit out of spam. Network Computing, Magazine Article, May 13. [4] Androutsopoulos I., Koutsias J., Chandrinos K. V., Paliouras G., and Spyropoulos C. D., 2000. An evaluation of Naive Bayesian anti-spam filtering. In Proceedings of the Workshop on Machine Learning in the New Information Age, 11th European Conference on Machine Learning (ECML), pp. 9–17. Barcelona, Spain.

110

E.P. SANZ ET AL.

[5] Androutsopoulos I., Paliouras G., Karkaletsis V., Sakkis G., Spyropoulos C. D., and Stamatopoulos P., 2000. Learning to filter spam e-mail: A comparison of a naive Bayesian and a memory-based approach. In Proceedings of the Workshop on Machine Learning and Textual Information Access, 4th European Conference on Principles and Practice of Knowledge Discovery in Databases (PKDD), pp. 1–13. Lyon, France. [6] Androutsopoulos I., Koutsias J., Chandrinos K. V., and Spyropoulos C. D., 2000. An experimental comparison of naive Bayesian and keyword-based anti-spam filtering with encrypted personal e-mail messages. In Proceedings of the 23rd Annual International ACM SIGIR Conference on Research and Development in Information Retrieval, pp. 160–167. Athens, Greece, ACM Press, New York, US. [7] Belkin N. J., and Croft W. B., 1992. Information filtering and information retrieval: Two sides of the same coin? Communications of the ACM, 35(12): 29–38. [8] Bell S., 2003. Filters causing rash of false positives: TelstraClear’s new virus and spam screening service gets mixed reviews. http://computerworld.co.nz/news.nsf/news/CC256CED0016AD1ECC256DAC000D90D4? Opendocument. [9] Bickel S., September 2006. ECML/PKDD discovery challenge 2006 overview. In Proceedings of the Discovery Challenge Workshop, 17th European Conference on Machine Learning (ECML) and 10th European Conference on Principles and Practice of Knowledge Discovery in Databases (PKDD), Berlin, Germany. [10] Biggio B., Giorgio Fumera, Ignazio Pillai, and Fabio Roli, August 23, 2007. Image spam filtering by content obscuring detection. In Proceedings of the Fourth Conference on Email and Anti-Spam (CEAS 2007), pp. 2–3. Microsoft Research Silicon Valley, Mountain View, California. [11] Bratko A., Cormack G. V., Filipic B., Lynam T. R., and Zupan B., Dec 2006. Spam filtering using statistical data compression models. Journal of Machine Learning Research, 7: 2699–2720. [12] Byun B., Lee C.-H., Webb S., and Calton P., August 2–3, 2007. A discriminative classifier learning approach to image modeling and spam image identification. In Proceedings of the Fourth Conference on Email and Anti-Spam (CEAS 2007), Microsoft Research Silicon Valley, Mountain View, California. [13] Caropreso M. F., Matwin S., and Sebastiani F., 2001. A learner-independent evaluation of the usefulness of statistical phrases for automated text categorization. In Text Databases and Document Management: Theory and Practice, A. G. Chin, editor, pp. 78–102. Idea Group Publishing, Hershey, US. [14] Carreras X., and Ma´rquez L., 2001. Boosting trees for anti-spam email filtering. In Proceedings of RANLP-2001, 4th International Conference on Recent Advances in Natural Language Processing. [15] Caruso J., December 2003. Anti-spam law just a start, panel says. Networld World, http://www. networkworld.com/news/2003/1218panel.html. [16] Claburn T., 2005. Constant struggle: How spammers keep ahead of technology, Message Pipeline. http://www.informationweek.com/software/messaging/57702892. [17] Cleary J. G., and Teahan W. J., 1997. Unbounded length contexts for PPM. The Computer Journal, 40(2/3): 67–75. [18] Cohen W. W., and Hirsh H., 1998. Joins that generalize: Text classification using WHIRL. In Proceedings of KDD-98, 4th International Conference on Knowledge Discovery and Data Mining, pp. 169–173. New York, NY. [19] Cormack G. V., and Lynam T. R., 2005. TREC 2005 spam track overview. In Proc. TREC 2005 – the Fourteenth Text REtrieval Conference, Gaithersburg. [20] Cormack G. V., and Lynam T. R., July 2005. Spam corpus creation for TREC. In Proc. CEAS 2005 – The Second Conference on Email and Anti-spam, Palo Alto.


111

[21] Cormack G. V., and Bratko A., July 2006. Batch and on-line spam filter evaluation. In CEAS 2006 – Third Conference on Email and Anti-spam, Mountain View. [22] Cormack G., Go´mez Hidalgo J. M., and Puertas Sanz E., November 6-9, 2007. Spam filtering for short messages. In ACM Sixteenth Conference on Information and Knowledge Management (CIKM 2007), Lisboa, Portugal. [23] Cosoi C. A., December 2006. The medium or the message? Dealing with image spam. Virus Bulletin, http://www.virusbtn.com/spambulletin/archive/2006/12/sb200612-image-spam.dkb. [24] Cranor L. F., and LaMacchia B. A., 1998. Spam! Communications of the ACM, 41(8): 74–83. [25] Dalvi N., Domingos P., Sanghai M. S., and Verma D., 2004. Adversarial classification. In Proceedings of the Tenth International Conference on Knowledge Discovery and Data Mining, pp. 99–108. ACM Press, Seattle, WA. [26] Dantin U., and Paynter J., 2005. Spam in email inboxes. In 18th Annual Conference of the National Advisory Committee on Computing Qualifications, Tauranga, New Zealand. [27] Deerwester S., Dumais S. T., Furnas G. W., Landauer T. K., and Harshman R., 1990. Indexing by latent semantic indexing. Journal of the American Society for Information Science, 41(6): 391–407. [28] Domingos P., and Pazzani M. J., 1997. On the optimality of the simple Bayesian classifier under zero-one loss. Machine Learning, 29(2–3): 103–130. [29] Domingos P., 1999. MetaCost: A general method for making classifiers cost-sensitive. In Proceedings of the Fifth International Conference on Knowledge Discovery and Data Mining, pp. 155–164. San Diego, CA, ACM Press. [30] Drucker H., Vapnik V., and Wu D., 1999. Support vector machines for spam categorization. IEEE Transactions on Neural Networks, 10(5): 1048–1054. [31] Dumais S. T., Platt J., Heckerman D., and Sahami M., 1998. Inductive learning algorithms and representations for text categorization. In Proceedings of CIKM-98, 7th ACM International Conference on Information and Knowledge Management, G. Gardarin, J. C. French, N. Pissinou, K. Makki, and L. Bouganim, eds. pp. 148–155. ACM Press, New York, US, Bethesda, US. [32] Dwork C., Goldberg A., and Naor M., August 2003. On memory-bound functions for fighting spam. In Proceedings of the 23rd Annual International Cryptology Conference (CRYPTO 2003). [33] Eckelberry A., 2006. What is the effect of Bayesian poisoning? Security Pro Portal, http://www. netscape.com/viewstory/2006/08/21/what-is-the-effect-of-bayesian-poisoning/. [34] Fawcett T., 2003. ‘‘In vivo’’ spam filtering: A challenge problem for KDD. SIGKDD Explorations, 5 (2): 140–148. [35] Fuhr N., Hartmann S., Knorz G., Lustig G., Schwantner M., and Tzeras K., 1991. AIR/X—a rulebased multistage indexing system for large subject fields. In Proceedings of RIAO-91, 3rd International Conference ‘‘Recherche d’Information Assistee par Ordinateur,’’ pp. 606–623. Barcelona, Spain. [36] Garcia F. D., Hoepman J.-H., and van Nieuwenhuizen J., 2004. Spam filter analysis. In Security and Protection in Information Processing Systems, IFIP TC11 19th International Information Security Conference (SEC2004), Y. Deswarte, F. Cuppens, S. Jajodia, and L. Wang, eds. pp. 395–410. Toulouse, France. [37] Gee K., and Cook D. J., 2003. Using latent semantic Iidexing to filter spam. ACM Symposium on Applied Computing, Data Mining Track. [38] Go´mez-Hidalgo J. M., Manã-Lo´pez M., and Puertas-Sanz E., 2000. Combining text and heuristics for cost-sensitive spam filtering. In Proceedings of the Fourth Computational Natural Language Learning Workshop, CoNLL-2000, Association for Computational Linguistics, Lisbon, Portugal. [39] Go´mez-Hidalgo J. M., 2002. Evaluating cost-sensitive unsolicited bulk email categorization. In Proceedings of SAC-02, 17th ACM Symposium on Applied Computing, pp. 615–620. Madrid, ES.

112

E.P. SANZ ET AL.

[40] Go´mez-Hidalgo J. M., Manã-Lo´pez M., and Puertas-Sanz E., 2002. Evaluating cost-sensitive unsolicited bulk email categorization. In Proceedings of JADT-02, 6th International Conference on the Statistical Analysis of Textual Data, Madrid, ES. [41] Goodman J., 2004. IP addreses in email clients. In Proceedings of The First Conference on Email and Anti-Spam. [42] Graham-Cumming J., 2003. The Spammer’s Compendium. In MIT Spam Conference. [43] Graham-Cumming J., 2004. How to beat an adaptive spam filter. In MIT Spam Conference. [44] Graham-Cumming J., February 2006. Does Bayesian poisoning exist? Virus Bulletin. [45] Graham-Cumming J., November 2006. The rise and rise of image-based spam. Virus Bulletin. [46] Graham P., 2002. A plan for spam. Reprinted in Paul Graham, Hackers and Painters, Big Ideas from the Computer Age, O’Really (2004). Available: http://www.paulgraham.com/spam.html. [47] Graham P., January 2003. Better Bayesian filtering. In Proceedings of the 2003 Spam Conference. Available:http://www.paulgraham.com/better.html. [48] Gray A., and Haahr M., 2004. Personalised, collaborative spam filtering. In Proceedings of the First Conference on Email and Anti-Spam (CEAS). [49] Hahn J., 2006. Image-based spam makes a comeback. Web Trends, http://www.dmconfidential.com/ blogs/column/Web_Trends/916/. [50] Hall R. J., March 1998. How to avoid unwanted email. Communications of the ACM. [51] Hird S., 2002. Technical solutions for controlling spam. In Proceedings of AUUG2002, Melbourne. [52] Hovold J., 2005. Naive Bayes spam filtering using word-position-based attributes. In Proceedings of the Second Conference on Email and Anti-spam, CEAS, Stanford University. [53] InfoWorld Test Center. Strong spam combatants: Brute anti-spam force takes on false-positive savvy. Issue 22 May 31, 2004. [54] Jeffrey E., and Friedl F., August 2006. Mastering Regular Expressions. 3rd edn. O’Really. [55] Joachims T., 1998. Text categorization with support vector machines: learning with many relevant features. In Proceedings of ECML-98, 10th European Conference on Machine Learning, pp. 137–142. Chemnitz, Germany. [56] Joachims T., 1999. Transductive inference for text classification using support vector machines. In Proceedings of ICML-99, 16th International Conference on Machine Learning, pp. 200–209. Bled, Slovenia. [57] Keogh E., Lonardi S., and Ratanamahatana C. A., 2004. Towards parameter-free data mining. In Proceedings of the Tenth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 206–215. Seattle, WA, USA, August 22–25, 2004). KDD ’04. ACM, New York, NY. [58] Kolcz A., Chowdhury A., and Alspector J., 2004. The impact of feature selection on signature-driven spam detection. In Proceedings of the First Conference on Email and Anti-Spam (CEAS). [59] Larkey L. S., and Croft W. B., 1996. Combining classifiers in text categorization. In Proceedings of SIGIR-96, 19th ACM International Conference on Research and Development in Information Retrieval, H.-P. Frei, D. Harman, P. Schaüble, and R. Wilkinson, eds. pp. 289–297. ACM Press, New York, US, Zurich, CH. [60] Lewis D. D., and Gale W. A., 1994. A sequential algorithm for training text classifiers. In Proceedings of SIGIR-94, 17th ACM International Conference on Research and Development in Information Retrieval, W. B. Croft and C. J. van Rijsbergen, eds. pp. 3–12. Springer Verlag, Heidelberg, DE, Dublin, IE. [61] Lewis D. D., 1998. Naive (Bayes) at forty: The independence assumption in information retrieval. In Proceedings of ECML-98, 10th European Conference on, Machine Learning, C. Ne´dellec and


[62] [63] [64] [65] [66] [67] [68] [69] [70] [71]

[72]

[73] [74]

[75] [76] [77]

[78] [79]

[80]

[81] [82]

113

C. Rouveirol, eds. pp. 4–15. Springer Verlag, Heidelberg, DE, Chemnitz, DE. Lecture Notes in Computer Science, 1398. Li Y. H., and Jain A. K., 1998. Classification of text documents. The Computer Journal, 41(8): 537–546. Lowd D., and Meek C., 2005. Adversarial Learning. In Proceedings of the Eleventh ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), ACM Press, Chicago, IL. Lucas M. W., 2006. PGP & GPG: email for the Practical Paranoid. No Starch Press. McCallum A., and Nigam K., 1998. A comparison of event models for Naive Bayes text classification. In Proceedings of the AAAI-98 Workshop on Learning for Text Categorization. MessageLabs, 2006. MessageLabs Intelligence: 2006 Annual Security Report. Available: http:// www.messagelabs.com/mlireport/2006_annual_security_report_5.pdf. Meyer T. A., and Whateley B., 2004. Spambayes: Effective open-source, bayesian based, email classification system. In Proceedings of the First Conference on Email and Anti-spam (CEAS). Mitchell T. M., 1996. Machine learning. McGraw Hill, New York, US. O’Brien C., and Vogel C., September 2003. Spam filters: Bayes vs. chi-squared; letters vs. words. In Proceedings of the International Symposium on Information and Communication Technologies. Pampapathi R., Mirkin B., and Levene M., 2006. A suffix tree approach to anti-spam email filtering. Mach. Learn, 65(1): 309–338. Pantel P., and Lin D., 1998. Spamcop: A spam classification and organization program. In Learning for Text Categorization: Papers from the 1998 Workshop, Madison, Wisconsin. AAAI Technical Report WS-98-05. Platt J., 1998. Fast training of support vector machines using sequential minimal optimization. B. Scho¨lkopf, C. Burges, and A. Smola, eds. Advances in Kernel Methods – Support Vector Learning. Postini White Paper, 2004. Why content filter is no longer enough: Fighting the battle against spam before it can reach your network. Postini Pre-emptive email protection. Provost F., and Fawcett T., 1997. Analysis and visualization of classifier performance: Comparison under imprecise class and cost distributions. In Proceedings of the Third International Conference on Knowledge Discovery and Data Mining. Provost J., 1999. Naive-bayes vs. rule-learning in classification of email. Technical report Department of Computer Sciences at the University of Texas at Austin. Quinlan R., 1986. Induction of decision trees. Machine Learning, 1(1): 81–106. Rigoutsos I., and Huynh T., 2004. Chung-kwei: A pattern-discovery-based system for the automatic identification of unsolicited e-mail messages (spam). In Proceedings of the First Conference on Email and Anti-Spam (CEAS). Saarinen J., 2003. Spammer ducks for cover as details published on the web, NZHerald. http://www. nzherald.co.nz/section/1/story.cfm?c_id=1&objectid=3518682. Sahami M., Dumais S., Heckerman D., and Horvitz E., 1998. A Bayesian approach to filtering junk e-mail. In Proceedings of the AAAI-98 Workshop on Learning for Text Categorization, AAAI Press, Madison, WI. Sakkis G., Androutsopoulos I., Paliouras G., Karkaletsis V., Spyropoulos C. D., and Stamatopoulos P., 2001. Stacking classifiers for anti-spam filtering of e-mail. In Proceedings of EMNLP-01, 6th Conference on Empirical Methods in Natural Language Processing, Pittsburgh, US, Association for Computational Linguistics, Morristown, US. Salton G., 1981. A blueprint for automatic indexing. SIGIR Forum, 16(2): 22–38. Salton G., and McGill M. J., 1983. Introduction to Modern Information Retrieval. McGraw Hill, New York, US.

114

E.P. SANZ ET AL.

[83] Samosseiko D., and Thomas R., 2006. The game goes on: An analysis of modern spam techniques. In Proceedings of the 16th Virus Bulletin International Conference. [84] Sculley D., and Brodley C. E., 2006. Compression and machine learning: a new perspective on feature space vectors. In Data Compression Conference (DCC’06), pp. 332–341. [85] Sebastiani F., 2002. Machine learning in automated text categorization. ACM Computing Surveys, 34(1): 1–47. [86] Seigneur J.-M., and Jensen C. D., 2004. Privacy recovery with disposable email addresses. IEEE Security and Privacy, 1(6): 35–39. [87] Sergeant M., 2003. Internet-level spam detection and SpamAssassin 2.50. In Spam Conference. [88] Stern H., Mason J., and Shepherd M., A linguistics-based attack on personalized statistical e-mail classifiers. Technical report CS-2004-06, Faculty of Computer Science, Dalhousie University, Canada. March 25, 2004. [89] Taylor B., 2006. Sender reputation in a large webmail service. In Proceedings of the Third Conference on Email and Anti-Spam (CEAS), Mountain View, California. [90] Teahan W. J., and Harper D. J., 2003. ‘‘Using compression based language models for text categorization’’. In Language Modeling for Information Retrieval, W. B. Croft and J. Laferty, eds. The Kluwer International Series on Information Retrieval, Kluwer Academic Publishers. [91] Theo V. D., 2004. New and upcoming features in SpamAssassin v3, ApacheCon. [92] Thomas R., and Samosseiko D., October 2006. The game goes on: An analysis of modern spam techniques. In Virus Bulletin Conference. [93] Turing A. M., 1950. Computing machinery and intelligence. Mind, 59: 433–460. [94] Watson B., 2004. Beyond identity: Addressing problems that persist in an electronic mail system with reliable sender identification. In Proceedings of the First Conference on Email and Anti-Spam (CEAS), Mountain View, CA. [95] Wiener E. D., Pedersen J. O., and Weigend A. S., 1995. A neural network approach to topic spotting. In Proceedings of SDAIR-95, 4th Annual Symposium on Document Analysis and Information Retrieval, pp. 317–332. Las Vegas, US. [96] Wittel G. L., and Wu F., 2004. On attacking statistical spam filters. In Proceedings of the Conference on Email and Anti-spam (CEAS). [97] Witten I. H., and Frank E., 2000. Data Mining: Practical Machine Learning Tools and Techniques with Java Implementations. Morgan Kaufmann, Los Altos, US. [98] Yang Y., and Chute C. G., 1994. An example-based mapping method for text categorization and retrieval. ACM Transactions on Information Systems, 12(3): 252–277. [99] Yang Y., and Pedersen J. O., 1997. A comparative study on feature selection in text categorization. In Proceedings of ICML-97, 14th International Conference on Machine Learning. D. H. Fisher, editor. [100] Yerazunis B., 2003. Sparse binary polynomial hash message filtering and the CRM114 discriminator. In Proceedings of the Spam Conference. [101] Yerazunis B., 2004. The plateau at 99.9. In Proceedings of the Spam Conference. [102] Zdziarski J., 2004. Advanced language classification using chained tokens. In Proceedings of the Spam Conference. [103] Zimmermann P. R., 1995. The Official PGP User’s Guide. MIT Press.

The Use of Simulation Techniques for Hybrid Software Cost Estimation and Risk Analysis MICHAEL KLA¨S Fraunhofer Institute for Experimental Software Engineering, 67663 Kaiserslautern, Germany

ADAM TRENDOWICZ Fraunhofer Institute for Experimental Software Engineering, 67663 Kaiserslautern, Germany

AXEL WICKENKAMP Fraunhofer Institute for Experimental Software Engineering, 67663 Kaiserslautern, Germany

¨ RGEN MU ¨ NCH JU Fraunhofer Institute for Experimental Software Engineering, 67663 Kaiserslautern, Germany

NAHOMI KIKUCHI Oki Electric Industry Co., Ltd., Warabi-shi, Saitama 335-8510, Japan

YASUSHI ISHIGAI Information-Technology Promotion Agency, Software Engineering Center, Bunkyo-Ku, Tokyo 113-6591, Japan


115


116

¨ S ET AL. M. KLA Abstract Cost estimation is a crucial field for companies developing software or softwareintensive systems. Besides point estimates, effective project management also requires information about cost-related project risks, for example, a probability distribution of project costs. One possibility to provide such information is the application of Monte Carlo simulation. However, it is not clear whether other simulation techniques exist that are more accurate or efficient when applied in this context. We investigate this question with CoBRAÒ ,1 a cost estimation method that applies simulation, that is, random sampling, for cost estimation. This chapter presents an empirical study, which evaluates selected sampling techniques employed within the CoBRAÒ method. One result of this study is that the usage of Latin Hypercube sampling can improve average simulation accuracy by 60% and efficiency by 77%. Moreover, analytical solutions are compared with sampling methods, and related work, limitations of the study, and future research directions are described. In addition, the chapter presents a comprehensive overview and comparison of existing software effort estimation methods.

1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 2. Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 2.1. CoBRAÒ Principles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 2.2. Simulation Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

3. Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 3.1. Software Effort Estimation Methods . . . . . . . . . . . . . . . . . . . . . 126 3.2. Overview of Random Sampling Techniques . . . . . . . . . . . . . . . . . 138

4. Problem Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 5. Analytical Approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 5.1. Point Estimation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 5.2. Distribution Computation . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

6. Stochastic Approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 6.1. The MC Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 6.2. The LH Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 6.3. Comparison of Stochastic Algorithms . . . . . . . . . . . . . . . . . . . . . 149

7. Experimental Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 7.1. Experimental Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 7.2. Experimental Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

1 CoBRA is a registered trademark of the Fraunhofer Institute for Experimental Software Engineering (IESE), Kaiserslautern, Germany.

SIMULATION TECHNIQUES FOR HYBRID COST ESTIMATION

117

7.3. Experimental Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158 7.4. Validity Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

8. Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

1. Introduction Rapid growth in the demand for high quality software and increased investment into software projects show that software development is one of the key markets worldwide [27, 28]. A fast changing market demands software products with ever more functionality, higher reliability, and higher performance. Moreover, in order to stay competitive, software providers must ensure that software products are delivered on time, within budget, and to an agreed level of quality, or even with reduced development costs and time. This illustrates the necessity for reliable software cost estimation, since many software organizations budget unrealistic software costs, work within tight schedules, and finish their projects behind schedule and budget, or do not complete them at all [100]. At the same time, software cost estimation is considered to be more difficult than cost estimation in other industries. This is mainly because software organizations typically develop products as opposed to fabricating the same product over and over again. Moreover, software development is a human-based activity with extreme uncertainties. This leads to many difficulties in cost estimation, especially in early project phases. These difficulties are related to a variety of practical issues. Examples include difficulties with project sizing, a large number of associated and unknown cost factors, applicability of cost models across different organizational contexts, or, finally, insufficient data to build a reliable estimation model on. To address these and many other issues, considerable research has been directed at gaining a better understanding of the software development processes, and at building and evaluating software cost estimation techniques, methods, and tools [12]. Traditionally, effort estimation has been used for the purpose of planning and tracking project resources. Effort estimation methods that grew upon those objectives do not, however, support systematic and reliable analysis of the causal effort dependencies when projects fail. Currently software industry requires effort estimation methods to support them in understanding their business and identifying potential sources of short-term project risks and areas of long-term process improvements. Moreover, in order to gain wider industrial acceptance, a candidate method should minimize the required overhead, for example, by utilizing a variety of already existing information sources instead of requiring extensive expert involvement and/or large project measurement databases. Yet, existing estimation methods (especially those currently used in the software industry) do not offer such comprehensive support.

118

¨ S ET AL. M. KLA

An example prerequisite to accepting a certain estimation method is its applicability within a particular context, which includes its adaptability to organization-specific characteristics such as availability of required data or effort required to apply the method. Usually, the latter two issues are contradictory: The less effort a method requires to build the estimation model, the more measurement data from previous projects is needed.2 Data-based methods focus on the latter exclusively. Contrariwise, expert-based methods require almost no measurement data, but obtaining estimates costs a lot of effort. Software organizations move between those two extremes, tempted either by low application costs or low data requirements. In fact, a great majority of organizations that actually use data-based methods do not have a sufficient amount of appropriate (valid, homogeneous, etc.) data as required by such methods. Hybrid methods offer a reasonable bias between data and effort requirements, providing at the same time reliable estimates and justifiable effort to apply the method [14, 18, 69]. Moreover, estimation methods are required to cope with the uncertainty inherent to software development itself as well as to the estimation activity. On the one hand, the preferred method should accept uncertain inputs. On the other hand, besides simple point estimates means to draw conclusions about the estimation uncertainty and effort-related project risk should be provided. The use of probabilistic simulation provides the possibility to deal with estimation uncertainty, perform cost risk analyses, and provide an add-on of important information for project planning (e.g., how probable it is not to exceed a given budget). One of the methods that respond to current industrial objectives with respect to effort estimation is CoBRAÒ [14], an estimation method developed at the Fraunhofer Institute for Experimental Software Engineering (IESE). The method uses sparse measurement data (size, effort) from already completed software projects in order to model development productivity and complements it with expert evaluations in order to explicitly model the influence of various project characteristics on productivity deviations. Random simulation is one of the core elements of the CoBRAÒ method; it is supposed to deal with estimation uncertainty introduced through expert evaluations. Experts first specify a causal model that describes which factors influence costs (and each other) and how. Afterwards, they quantify the impact of each factor on costs by giving the maximal, minimal, and most likely increase of costs dependent on a certain factor. The simulation component of CoBRAÒ processes this information into a probability distribution of project costs. This provides decision makers with a robust basis for managing software development costs, for example, planning software costs, analyzing and mitigating cost-related software risks, or benchmarking projects

2

The more data is available, the less expert involvement is required and the company’s effort is reduced. This does not include the effort spent on collecting the data. Above a certain maturity level, companies have to collect the data needed anyway.


119

with respect to software costs. Numerous practical benefits of CoBRAÒ have been proven in various industrial applications (e.g., [14, 97]). Originally, CoBRAÒ utilized the Monte Carlo (MC) simulation technique. Yet, experience from applying the CoBRAÒ method in an industrial project [14] suggested that MC might not be the optimal solution for that purpose. Latin Hypercube (LH) was proposed as an alternative method that can improve the performance of the CoBRAÒ implementation. Yet, neither a definition of the performance nor empirical evidence is available that would support this hypothesis. This led us to the question of whether there exist techniques that deliver more accurate results in the context of software cost estimation in general, and for the CoBRAÒ method in particular, than simple MC sampling or performing the simulation in a more efficient way. In addition, we are interested in the extent of accuracy improvement that can be expected from the use of such a technique. In this chapter, we describe analytical considerations as well as the results of an empirical study we conducted in order to answer these questions. Our major objective was to evaluate the magnitude of possible CoBRAÒ accuracy and efficiency improvement related to the selection of a certain simulation technique and its parameters. In order to achieve our goal, we derived several analytical error estimations and compared selected simulation techniques (including MC and LH) in an experiment employing various settings (i.e., parameters) within the same CoBRAÒ application (i.e., on the same input data). The chapter is organized as follows: Section 2 presents the necessary theoretical foundations regarding the CoBRAÒ cost estimation method and the simulation techniques relevant for this chapter. Section 3 provides an overview of related work. It presents a comprehensive overview and comparison of existing estimation methods as a well as summary of common simulation techniques. In Section 4, the research questions (RQ) are described. Section 5 presents analytical results regarding one of the research questions. Section 6 sketches simulation algorithms that were selected for comparison and motivates why an empirical study is necessary for such a comparison. Section 7 presentsthe empirical study, including its results and limitations. Finally, Section 8 summarizes the findings of the study and outlines perspectives of further research work.

2. 2.1

Background

CoBRAÒ Principles

CoBRAÒ is a hybrid method combining data- and expert-based cost estimation approaches [14]. The CoBRAÒ method is based on the idea that project costs consist of two basic components: nominal project costs (Equation 1) and a cost overhead (CO) portion (Equation 2).

¨ S ET AL. M. KLA

120

Cost ¼Nominal Productivity Size þ Cost Overhead |fflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflffl{zfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflffl} Nominal Cost X Multiplieri ðCost Factori Þ Cost Overhead ¼ i

þ

XX i

ð1Þ

ð2Þ Multiplierij Cost Factori ; Indirect Cost Factorj

j

Nominal cost is the cost spent only on developing a software product of a certain size in the context of a nominal project. A nominal project is a hypothetical ‘ideal’ project in a certain environment of an organization (or business unit). It is a project that runs under optimal conditions; that is, all project characteristics are the best possible ones (‘perfect’) at the start of the project. For instance, the project objectives are well defined and understood by all staff members and the customer and all key people in the project have appropriate skills to successfully conduct the project. CO is the additional cost spent on overcoming imperfections of a real project environment such as insufficient skills of the project team. In this case, a certain effort is required to compensate for such a situation, for example, team training has to be conducted. In CoBRAÒ , CO is modeled by a so-called causal model. The causal model consists of factors affecting the costs of projects within a certain context. The causal model is obtained through expert knowledge acquisition (e.g., involving experienced project managers). An example is presented in Fig. 1. The arrows indicate direct and indirect relationships. A sign (‘+’ or ‘–’) indicates the way a cost factor contributes to the overall project costs. The ‘+’ and ‘–’ represent a positive and negative relationship, respectively; that is, if the factor increases, the project costs will also increase (‘+’) or decrease (‘–’). For instance, if Requirements volatility Requirements volatility

Disciplined requirements management

− +

+

Application Platform domain capabilities capabilities

Cost − Customer participation

−

+

+

Development team capabilities FIG. 1. Example causal cost model.


121

increases, costs will also increase. One arrow pointing to another one indicates an interaction effect. For example, an interaction exists between Disciplined requirements management and Requirements volatility. In this case, increased disciplined requirements management compensates for the negative influence of volatile requirements on software costs. The CO portion resulting from indirect influences is represented by the second component of the sum shown in Equation 2. In general, CoBRAÒ allows for expressing indirect influences on multiple levels (e.g., influences on Disciplined requirements management and influences on influences thereon). However, in practice, it is not recommended for experts to rate all factors due to the increased complexity of the model and the resulting difficulties and efforts. Further details on computing the CO can be found in [14]. The influence on costs and between different factors is quantified for each factor using experts’ evaluation. The influence is measured as a relative percentage increase of the costs above the nominal project. For each factor, experts are asked to give the increase of costs when the considered factor has the worst possible value (extreme case) and all other factors have their nominal values. In order to capture the uncertainty of evaluations, experts are asked to give three values: the maximal, minimal, and most likely CO for each factor (triangular distribution). The second component of CoBRAÒ , the nominal project costs, is based on data from past projects that are similar with respect to certain characteristics (e.g., development and life cycle type) that are not part of the causal model. These characteristics define the context of the project. Past project data is used to determine the relationship between CO and costs (see Equation 1). Since it is a simple bivariate dependency, it does not require much measurement data. In principle, merely project size and effort are required. The size measure should reflect the overall project volume, including all produced artifacts. Common examples include lines of code or function points [60]. Past project information on identified cost factors is usually elicited from experts. On the basis of the quantified causal model, past project data, and current project characteristics, a CO model (distribution) is generated using a simulation algorithm (e.g., MC or LH). The probability distribution obtained could be used further to support various project management activities, such as cost estimation, evaluation of cost-related project risks, or benchmarking [14]. Figure 2 illustrates two usage scenarios using the cumulative cost distribution: Calculating the project costs for a given probability level and computing the probability for exceeding given project costs. Let us assume (scenario A) that the budget available for a project is 900 U and that this project’s costs are characterized by the distribution in Fig. 2. There is roughly a 90% probability that the project will overrun this budget. If this probability

¨ S ET AL. M. KLA

122 1.0

Probability

0.8

0.6

0.4 B 0.2 A 0.0 800

1000

1200

1400

Cost FIG. 2. Example cumulative cost distribution.

represents an acceptable risk in a particular context, the project budget may not be approved. On the other hand, let us consider (scenario B) that a project manager wants to minimize the risks of overrunning the budget. In other words, the cost of a software project should be planned so that there is minimal risk of exceeding it. If a project manager sets the maximal tolerable risk of exceeding the budget to 30%, then the planned budget for the project should not be lower than 1170 U. The advantage of CoBRAÒ over many other cost estimation methods is its low requirements with respect to measurement data. Moreover, it is not restricted to certain size and cost measures. The method provides means to develop an estimation model that is tailored to a certain organization’s context, thus increasing model applicability and performance (estimation accuracy, consistency, etc.) A more detailed description of the CoBRAÒ method can be found in [14].

2.2

Simulation Techniques

Simulation is an approach to obtaining knowledge about the behavior or properties of a real system by creating and investigating a similar system or a mathematical model of the system. Before computer simulations were possible, formally modeled systems had to be analytically solved to enable predicting the behavior of the system from a given


123

number of parameters and initial conditions. Stochastic computer simulation methods like MC sampling and LH sampling make it possible to handle more complex systems with larger numbers of input variables and more complex interactions between them.

2.2.1 Basic Principles of the MC Method The MC method [90] is the most popular simulation approach, used in numerous science areas (see Section 3). One significant advantage of the MC method is the simplicity of its algorithmic structure. In principle, an MC algorithm consists of a process of producing random events (so-called trials). These events are used as input for the mathematical model and produce possible occurrences of the observed variable. This process is repeated n times (iterations) and the average of overall occurrences is calculated as a result. The mathematical foundation of the MC method is built upon the strong law of large numbers [59]: Let i(i 2 N) be a sequence of integrable, independent random variables with identical distributions and a finite expected value m ¼ E(i). It follows that for nearly any realization o: Pn i¼1 i ðoÞ ¼m ð3Þ lim n!1 n This means that we can transform into the integral, stochastically, by taking repeated samples from and averaging i(o). The expected error for n iterations can be estimated with [90]: ! 1 X z s ð4Þ i ðoÞ m pffiffiffi EAR ¼ E n i¼1 n where s is the standard derivation of the random variable i. In this chapter, however, we also consider sampling as an attempt to approximate an unknown probability distribution with the help of randomly sampled values. In the context of MC, this means that we are not only interested in the expectation of the random variable (), but also in an approximation of its distribution D, describable by its probability density function (pdf ) f(x) [90]. The range of random samples obtained (result of independent realizations of ) build up an interval [x,y]. After breaking it into a number of equal length intervals and counting the frequency of the samples that fall into each interval, we may construct a histogram that approximates the density distribution of the sampled random variable (see Fig. 3).

¨ S ET AL. M. KLA

124 Probability

8

11

18

24

21

12

6

x

η y

FIG. 3. Example histogram of a probability variable.

2.2.2 Stratification and LH Sampling The expected error of the MC method depends on the number of iterations n and the variance s of the random variable (see Equation 4). The error can thus be reduced either by increasing the number of trials and/or reducing the variance of the random variable. Numerous variance reduction techniques (VRT) are discussed in the literature (see Section 3). One of them is stratification. In this section, we present the idea of stratification in general, as well as LH as a modification for multidimensional problems that can be used without deeper knowledge of the random variable. We explain both: how LH can be used for mean computation and how it can be used for sampling. When we use stratification for variance reduction, we break the domain of the input distribution into s independent domains (so-called strata). In a one-dimensional case, this is simply a partitioning of the range of the input distribution (Fig. 4). If we use strata of equal size and consider the input variable x as being uniformly distributed across the half-open interval [0,1), we can get random variables xj for each j-th strata as: jx ð5Þ xj ¼ s So, we can simulate any random variable with the density function f(x) if its inverse cumulative density F–1(x) is given: xS ¼

m;s m;s 1 X 1 X 1 i; j ¼ F xj with n ¼ m s m s i , j¼1 n i; j¼1

ð6Þ


125

Probability 1

F−1 η1,3 (ω)

η

FIG. 4. Example stratification for s and n ¼ 4.

s

s

X X X X

X X X X

X X X X

X X X X

X X X s

X s

FIG. 5. Two-dimensional straightforward application of stratification requires 16 cells to get four strata (left), the LH algorithm selects only four cells (right).

Moreover, we obtain for m ¼ 1, a variance reduction of: 2 n X E Ej Varnew ¼ Varold n2 j¼1

ð7Þ

where E is the expectation of F–1(x) over [0,1] and Ej is the expectation of F–1(x) over strata j. In the multidimensional case, we have the problem that a straightforward generalization is not efficient [50]. The reason is that we must sample in too many cells (subintervals). If we want s strata in any dimension d, we need sd cells to partition the input variable(s) (Fig. 5). The LH technique [64] overcomes this problem by sampling each stratum only once. In order to obtain a perfect stratification within a single dimension, each

¨ S ET AL. M. KLA

126

randomly selected stratum is taken only once and independently of the strata within other dimensions. This can be guaranteed by using d independent permutations pk of {1, . . ., s} with k ¼ 1, . . ., d. For s=n, we obtain the following estimator that converges against the expected value E() (see also Equation 3): xLH ¼

n n 1X 1X pk ð jÞ x i ¼ F1 xj;1 ; :::; xj;d with xj;k ¼ n j¼1 n j¼1 n

ð8Þ

In order to sample a pdf using the LH approach, we can use the same procedure as for the MC approach (see Section 2.2.1). In fact, LH is an improvement (special case) of the MC approach. Therefore, the error can be estimated in the same way as for MC (see Section 2.2.1).

3. 3.1

Related Work

Software Effort Estimation Methods

3.1.1 Classification of Existing Effort Estimation Methods Software researchers have made a number of attempts to systematize software effort estimation methods [8, 9, 12, 103]. Proposed classification schemes are subjective and there is no agreement on the best one. Some of the classes, like Price-to-Win, cannot really be considered to be an estimation technique. Other classes are not orthogonal, for example, expert judgment can be used following a bottom-up estimation strategy. The systematization we propose in this chapter (Fig. 6) is probably also not fully satisfactory, but is designed to overview the current status of effort estimation research and evaluate it against the most recent industrial requirements.

3.1.1.1 Data-driven Methods. Data-driven (data-intensive) methods refer to methods that provide effort estimates based on an analysis of measurement project data. Proprietary Versus Non-proprietary. Proprietary effort estimation methods refer to methods that are not fully documented in the public domain. Examples of proprietary approaches are PRICE-S [19], SPQR/100 [44], and SoftCost-R [77]. Because of the lack of sufficient documentation, we exclude these methods from further consideration.


127

FIG. 6. Classification of software effort estimation methods.

Model-Based Methods. Model-based methods provide a model that relates the dependent variable (effort) to one or more independent variables, typically a size measure and one or more effort factors. The model is built, based on the historical project data and used for predictions; the data are generally not needed at the time of the prediction. An estimation model may be characterized by different parameters. They might be specified a priori before analyzing the project data (parametric methods) or determined completely from the data at the time of model development (nonparametric methods).

Parametric Model-Based Methods. Specify the parameters of the estimation model a priori. Statistical regression methods, for instance, require a priori specification of the model’s functional form and assume estimation errors to follow certain parametric distributions. Typical functional forms of the univariate regression include [54, 61, 82]: linear, quadratic, Cobb-Douglas, log-linear, and Translog. Multivariate regression, on the other hand, constructs models that relate effort to many independent variables [20, 66]. Typical regression methods fit regression parameters to historical project data using ordinary least squares strategy. Yet, this technique is commonly criticized for its sensitivity to data outliers. As an alternative,

128

¨ S ET AL. M. KLA

robust regression has been proposed by several authors [61, 67]. Another statistical approach to handle unbalanced data is Stepwise Analysis of Variance (Stepwise ANOVA), which combines classical ANOVA with OLS regression [53]. In each step of an iterative procedure, ANOVA is applied to identify the most significant effort factor and remove its effect by computing the regression residuals; ANOVA is then applied again using the remaining variables on the residuals. Another critical point regarding classical regression is that it does not handle noncontinuous (ordinal and categorical) variables. In order to solve that problem, generalized regression methods such as Categorical Regression [3] and Ordinal Regression [82] have been proposed. Fixed-model estimation methods such as COCOMO [8, 10], SLIM [75], and SEER–SEM [40] also belong to the group of parametric methods. In fact, all three models have their roots in the early Jensen’s regression models [41, 42]. All of them actually represent regression models that were once built on multiple proprietary project data and were intended to be applied ‘as is’ in contexts that may significantly differ from the one they were built in. Yet, the software estimation community agrees that effort models work better when calibrated with local data [24, 66]. In order to improve the performance of fixed-model methods when applied within a specific context, various adjustment techniques have been proposed, such as periodical updates of fixed models to reflect current trends and changes in the software domain are (e.g., the family of COCOMO models [8, 10]). The frequency of official model calibrations might, however, not be sufficient to keep them up to date [66]. Therefore, additional mechanisms to fit fixed models to local context have been suggested. Already, authors of fixed models are proposing certain local calibration techniques as part of a model’s application procedures. Moreover, several adjustment approaches were proposed by independent researchers [66, 89]. The COCONUT approach, for instance, calibrates effort estimation models using an exhaustive search over the space of COCOMO I calibration parameters [66]. Recently, a parametric regression method that adapts ecological predator–prey models to represent dynamics of software testing and maintenance effort has been proposed [17]. The basic idea is that the high population of prey allows predators to survive and reproduce. In contrast, a limited population of prey reduces the chances of predators to survive and reproduce. A limited number of predators, in turn, creates favorable conditions for the prey population to increase. Authors adopt this phenomenon to software maintenance and testing. Software corrections represent predating software defects, and associated effort is fed by defects being discovered by the user. Perfective and adaptive maintenance are both fed by user needs, and the corresponding maintenance effort adapts itself to the number of change requests. Parametric estimation also adapts selected machine learning approaches. Examples include Artificial Neural Networks (ANN). Network parameters such as architecture or input factors must be specified a priori; the learning algorithm then


129

searches for values of parameters based on project data. The simplest ANN, so-called single-layer perceptron, consists of a single layer of output nodes. The inputs are fed directly to the outputs via a series of weights. In this way, it can be considered the simplest kind of feed-forward network. The sum of the products of the weights and the inputs is calculated in each node, and if the value is above a certain threshold (typically 0), the neuron fires and takes the activated value (typically 1); otherwise, it takes the deactivated value (typically –1). Neurons with this kind of activation function are also called McCulloch–Pitts neurons or threshold neurons. In the area of effort estimation, the sigmoid and Gaussian functions are usually used. Since singleunit perceptrons are only capable of learning linearly separable patterns, multilayer perceptrons are used to represent nonlinear functions. Examples of such ANN are the Multilayer feed-forward back-propagation perceptron (MFBP) [32] and the Radial Basis Function Network (RBFN) [32, 87]. The Cerebellar Model Arithmetic Computer (CMAC), also known as Albus perceptron, is a special type of a neural network, which represents a multidimensional function approximator [81]. It discretizes values of continuous input to select so-called training points. CMAC first learns the function at training points and then interpolates to intermediary points at which it has not been trained. The CMAC method operates in a fashion similar to a lookup table, using a generalization mechanism so that a solution learned at one training point in the input space will influence solutions at neighboring points. Finally, Evolutionary Algorithms (EA) represent an approach that can be used to provide various types of traditionally data-based estimation models. EA simulates the natural behavior of a population of individuals (chromosomes) by following an iterative procedure based on selection and recombination operations to generate new individuals (next generations). An individual (chromosome) is usually represented by a finite string of symbols called chromosome. Each member of a population encodes a possible solution in a given problem search space, which is comprised of all possible solutions to the problem. The length of the string is constant and completely dependent of the problem. The finite string of symbol alphabet can represent real-valued encodings [2, 79], tree representation [21], or software code [83]. In each simulation iteration (generation), relatively good solutions produce offspring that replace relatively worse ones retaining many features of their parents. The relative quality of a solution is based on the fitness function, which determines how good an individual is within the population in each generation, and what its chance of reproducing is, while others (worse) are likely to disappear. New individuals (offspring) for the next generation are typically created by using two basic operations, crossover and mutation. Shukla, for instance, used EA to generate an optimal ANN for a specific problem [88]. The method was called a Neuro-genetic Effort Estimation Method (GANN).

130

¨ S ET AL. M. KLA

The author encoded the neural network using so-called strong representation and learned it using genetic algorithm. The ANN generated in each cycle was evaluated against a fitness function, defined as the inverse of the network’s prediction error when applied on the historical project data.

Nonparametric Model-Based Methods. Differ from parametric methods in that the model structure is not specified a priori but instead is determined from quantitative (project) data. In other words, nonparametric estimators produce their inferences free from any particular underlying functional form. The term nonparametric is not meant to imply that such methods completely lack parameters, but rather that the number and nature of the parameters are flexible and not fixed in advance. Typical nonparametric methods originate from the machine learning domain. The most prominent examples are decision tree methods. The most popular one in the artificial intelligence domain, the C4.5 algorithm has not been exploited much in the software effort estimation domain due to its inability to handle numerical input data [2]. Proposed in [11], the classification and regression trees (CART) method overcame this limitation and is applicable for both categorical and numerical data. The CART algorithm was re-implemented in numerous software tools such as CART [11], CARTX [93], and GC&RT [96]. Decision trees group instances (software projects) with respect to a dependent variable. A decision tree represents a collection of rules of the form: if (condition 1 and . . .and condition N) then Z and basically forms a stepwise partition of the data set being used. In that sense, decision trees are equivalent to decision rules, that is, a decision tree may be represented as a set of decision rules. Successful applications in a number of different domains have motivated software researchers to apply dedicated rule induction (RI) methods that generate effort estimation decision rules directly from statistical data [63]. Finally, some applications of the EA can be classified as nonparametric, for instance, EA applied to generate regression equations (EA Regression) [16, 21]. In that case, the elements to be evolved are trees representing equations. That is, the population P of the algorithm is a set of trees to which the crossover and mutation operators are applied. A crossover exchanges parts of two equations, preserving the syntax of the mathematical expression, whereas a mutation randomly changes a term of the equation (function, variable or constant). The terminal nodes are constants or variables, and not-terminals are basic functions that are available for system definition. Each member of the population (regression equation) is evaluated with respect to the fitness function defined as the average estimation error on the historical project data obtained when using the member. Shan et al. applied so-called Grammar Guided Genetic Programming (GGGP) to generate computer programs that estimate software development effort [83]. Generating computer programs using EA creates a separate area of machine learning


131

called Genetic Programming (GP). The objective of GP is to optimize a population of computer programs according to a fitness function determined by a program’s ability to perform a given computational task (in this case accurately estimate software effort). In GGGP, generation process is guided by a specific language grammar that (1) imposes certain syntactical constraints and (2) incorporates background knowledge into the generation process. The grammar used resulted in models that are very similar to regression. The means square estimation error on the historical project data was applied as the fitness function to evaluate the model-generated GGGP process. Finally, Aguilar-Ruiz et al. applied EA to generate a set of Hierarchical Decision Rules (HIDER) for the effort classification problem [2]. Members of the population are coded using a vector of real values. The vector consists of pair values representing an interval (lower and upper bound) for each effort factor. The last position in the vector represents a discrete value of effort (effort class). The EA algorithm extracts decision rules from this representation. Each member of the population (decision rule) is evaluated with respect to the fitness function that discriminates between correct and incorrect effort predictions (classifications) of historical projects using the member.

Semi-parametric Model-Based Methods. Represent methods that contain both parametric and nonparametric components. In a statistical sense, a semi-parametric method produces its inferences free from a particular functional form but within a particular class of functional forms, for example, it might handle any functional form within the class of additive models. A typical example of the semi-parametric method where parametric and nonparametric elements were merged is the integration of decision trees and ordinary least squares regression (CART+OLS) proposed by Briand and colleagues [12, 13]. The method generates a CART tree and applies regression analysis to interpret projects at each terminal node of the tree. The application of EA to generate Multiple Regression Splines (MARS) is another example of the semi-parametric method [79]. Instead of building a single parametric model, EA-MARS generates multiple parametric models, using linear regression. In this case, the search space comprises a set of cut-points (CP) in the independent variable (e.g., software size measured in function points, FP), so a different parametric estimation model can be used for the intervals that comprise such CP. Memory-based Methods. Model-based methods, such as neural networks or statistical regression, use data to build a parameterized model (where parameters must be specified a priori or might be learned from data). After training, the model is used for predictions and the data are generally not needed at the time of prediction. In contrast, memory-based methods (or analogy-based methods) do not create a

132

¨ S ET AL. M. KLA

model but explicitly retain the available project data, and use them each time a prediction of a new project needs to be made. Each time an estimate is to be provided for a new project (target), the project data (case base) is searched for the projects (analogues) that are most similar to the target. Once the most similar projects are found, their actual efforts are used as a basis for estimation. The Case-based Reasoning (CBR) method represents an exact implementation of the memory-based estimation paradigm. It estimates a new project (target) by adapting the effort of the most similar historical projects (analogues) [49]. In order to find project analogies, the CBR method first selects the most relevant characteristics of a software project and defines a project similarity measure upon it. The early methods, such as the Analogy Software Tool (ANGEL), required a priori selection of the most significant characteristics or simply used all characteristics available in the data repository [86]. Later, automatic factor selection [49] and weighting [57] techniques were applied that optimize the performance of the CBR estimator. The most commonly used similarity measure is based on the Euclidian distance [86]. The Gray Relational Analysis Based Software Project Effort (GRACE) method computes the gray relational grade [91], and the Collaborative Filtering (CF) method uses a similarity measure proposed in the field of information retrieval to evaluate the similarity between two documents [71]. The most recent AQUA method [57] uses a locally weighted similarity measure, where local weights are computed for different project attributes dependent on their type (nominal, ordinal, continuous, set, fuzzy, etc.) The Analogical and Algorithmic Cost Estimator (ACE) and Bootstrap Based Analogy Cost Estimation (BRACE) consider several alternative similarity measures. ACE uses average similarity computed over several distance measures [39, 102, 103], whereas BRACE analyzes each alternative similarity measure to select the one that entails optimal estimation performance [94, 95]. In addition, scaling techniques are used to transform values of project characteristics such that all have the same degree of influence, independently of the choice of units [71, 86, 91]. On the basis of the results of the similarity analysis, analogues are selected to base target estimates on. One group of methods proposes a small constant number (1–3) of nearest neighbors [13, 65, 86, 102]. Other methods, such as BRACE [94] and AQUA [57], determine the optimal number of analogies in a cross-validation analysis. The effort of selected analogues is then adapted to predict the target project. In case of a single analogue, its effort may be adopted [13] or additionally adjusted using the size of the analogue and target projects [94, 102]. Adapting several analogues includes median, mean, distance-weighted mean [65, 71, 86], and inverse rank weighted mean [49, 65]. Again, BRACE analyzes several alternative adaptation approaches to determine the optimal one [94]. Another way of implementing memory-based estimation is represented by the Optimized Set Reduction (OSR) method [13, 15, 104]. On the basis of the characteristics


133

of the target project, OSR iteratively partition the set of project data into subsets of similar projects that assure increasing information gain. Similarly to decision trees, the final effort estimate is based on projects in the terminal subset.

Composite Methods. These integrate elements of the model- and memory-based methods. Typical examples are applications of CBR or OLS regression to adapt projects in the CART terminal node [12, 13] or OSR terminal subset [47]. Another example is the usage of cluster analysis to group similar projects in order to facilitate the training of the neural network [56]. The analogy with virtual neighbor method (AVN) represents a more sophisticated combination of model- and memory-based methods. It enhances the classical CBR approach in that the two nearest neighbors of a target project are identified based on the normalized effort, which is computed from the multiple-regression equation. Moreover, AVN adjusts the effort estimation by compensating for the location of the target project relative to the two analogues.

3.1.1.2 Expert-Based Methods.

Expert-based estimation methods are based on the judgment of one or more human experts. The simplest instance of the unstructured expert-based estimation is the so-called Guesstimation approach, where a single expert provides final estimates. An expert could just provide a guess (‘rule-ofthumb’ method) or give estimates based on more structured reasoning, for example, breaking the project down into tasks, estimating them separately and summing those predictions into a total estimate (bottom-up approach). An example formal way of structuring expert-based effort estimation is represented by the Analytic Hierarchy Process (AHP) method, which systematically extracts a subjective expert’s predictions by means of pair-wise comparison [84]. Because of many possible causes of bias in individual experts (optimist, pessimist, desire to win, desire to please, and political), it is preferable to obtain estimates from more than one expert [68]. A group of experts may, for instance, provide their individual estimates, which are then aggregated to a final estimation, for example, by use of statistical mean or median. This is quick, but subject to adverse bias by individual extreme estimates. Alternative group consensus approaches try to hold group meetings in order to obtain expert agreement with regard to a single estimate. Examples of such methods are Wide-band Delphi [10, 68], Estimeeting [98], and, recently defined in the context of agile software development, Planning Game [7]. A more formal approach to integrating uncertain estimates of multiple human experts is Stochastic Budgeting Simulation (SBS) [22]. SBS employs random sampling to combine effort of individual effort items (work products or development activities) and project risks specified by experts in terms of triangular or Erlang distribution.

134

¨ S ET AL. M. KLA

3.1.1.3 Hybrid Methods. Hybrid methods combine data- and expertbased methods. In practice, hybrid methods are perceived as the answer to the more and more common observation that human experts, when supported by low-cost analytical techniques, might be the most accurate estimation method [43]. The ESTOR method, for instance, [69] provides the initial effort of a target project based on the CBR estimation and then adjusts it by applying a set of expert-based rules, which account for the remaining differences between the analog and the target project. The Cost Estimation, Benchmarking, and Risk Analysis (CoBRA) method applies expert-based effort causal modeling to explain the variance on the development production rate measured as effort divided by size [14, 99]. Recently, the software research community has given much attention to Bayes Theorem and Bayesian Belief Networks (BBN). Chulani, for instance, employed Bayes theorem to combine a priori information judged by experts with data-driven information and to calibrate one of the first versions of the COCOMO II model, known as COCOMO II.98 [8]. Several researchers have adapted BBN to build causal effort models and combine a priori expert judgments with a posteriori quantitative project data [23, 74]. Recently, BBN was used to construct the probabilistic effort model called COCOMO-U, which extends COCOMO II [8] to handle uncertainty [107]. 3.1.2 Handling Uncertainty Uncertainty is inherent to software effort estimation [46, 52]. Yet, software managers usually do not understand how to properly handle the uncertainty and risks inherent in estimates to improve current project budgeting and planning processes. Kitchenham et al. conclude that estimation, as an assessment of a future condition, has inherent probabilistic uncertainty, and formulate four major sources of estimation uncertainty: measurement error, model error, assumption error, and scope error [52]. We claim that limited cognition of effort dependencies is another major source of estimation uncertainty. We distinguish two major sources of effort estimation uncertainty: probabilistic and possibilistic. Probabilistic uncertainty reflects the random character of the underlying phenomena, that is, the variable character of estimation problem parameters. Uncertainty is considered here in terms of probability, that is, by the random (unpredictable, nondeterministic) character of future software project conditions, in particular, factors influencing software development effort. Possibilistic uncertainty (epistemological uncertainty) reflects the subjectivity of the view on modeled phenomena due to its limited cognition (knowledge and/or experience). This may, for instance, include limited granularity of the description of the modeled phenomena, that is, a finite number of estimation parameters (e.g., effort factors and the ways they influence effort). The lack of knowledge may, for instance, stem from a partial lack of data, either because this data is impossible to collect or too expensive to


135

collect, or because the measurement devices have limited precision. Uncertainty is considered here in terms of possibilities.

Handling Probabilistic Uncertainty. The most common approach, which actually explicitly refers to probabilistic uncertainty, is based on the analysis of the probability distribution of given input or output variables. Representing effort as a distribution of values contributes, for instance, to better understanding of estimation results [52]. Motivated by this property, a number of estimation methods that operate on probability distributions have been proposed. Recent interest in BBN [23, 74, 107] is one example of this trend. Another one is generally acknowledged to be the application of random sampling over the multiple estimation inputs represented by probability distribution [14, 22, 34, 75, 76, 94, 99]. The resulting effort distribution may then be interpreted using various analysis techniques. Confidence and prediction intervals are commonly used statistical means to reflect predictive uncertainty. Human estimators are traditionally asked to provide predicted min–max effort intervals based on given confidence levels, for example, ‘almost sure’ or ‘90 percent confident.’ This approach may, however, lead to overoptimistic views regarding the level of estimation uncertainty [44]. Jrgensen proposes an alternative, so-called pX-effort approach, where instead of giving a number, the human estimator should give ranges and views based on probabilistic distributions [45]. The pX-view means there is an X percent probability of not exceeding the estimate. Handling Possibilistic Uncertainty. In practice, handling possibilistic uncertainty involves mainly the application of the fuzzy set theory [108]. The approaches proposed in the effort estimation domain can be principally classified into two categories: (1) fuzzifying existing effort estimation methods and (2) building-specific rulebased fuzzy logic models. The first approach simply adapts existing software effort estimation methods to handle the uncertainty of their inputs and outputs using fuzzy sets. A typical estimation process consists of three steps: (1) fuzzification of inputs, (2) imprecise reasoning using fuzzy rules, and (3) de-fuzzification of outputs. Inputs and outputs can be either linguistic or numeric. Fuzzification involves finding the membership of an input variable with a linguistic term. The membership function can, in principle, be either defined by human experts or analytically extracted from data, whereas fuzzy rules are usually defined by experts. Finally, de-fuzzification provides a crisp number from the output fuzzy set. One example implementation of such an idea is a series of fuzzy-COCOMO models [1, 38, 58, 70]. Other adaptations of traditional estimation methods include fuzzyfying similarity measures within CBR methods [37, 57] or information gain measure in decision trees [35]. Rule-based fuzzy logic models directly provide a set of fuzzy rules that can then be used to infer predictions based on the fuzzy inputs [29, 62]. Fuzzy rules may be based

136

¨ S ET AL. M. KLA

on human judgment [61] or learned from empirical data [106]. Neuron-fuzzy systems (NFS) represent a hybrid approach to learn fuzzy rules. The equivalence between neural networks (ANN) and fuzzy logos systems makes it possible to create initial fuzzy rules based on expert judgment, translate them into equivalent ANN, and learn weights for the rules from quantitative data [26]. Neuro-Fuzzy COCOMO employs NFS to individually model each linguistic input of the COCOMO model [36]. Another approach to handle possibilistic uncertainty is based on the rough sets theory [73]. A rough set is a formal approximation of a crisp set (i.e., conventional set) in terms of a pair of sets, which give the lower and the upper approximation of the original set. The lower and upper approximation sets themselves are crisp sets in the standard version of the rough sets theory. The rough sets theory was recently applied within the AQUA+ method to cover the uncertain impact of effort drivers on effort [57].

3.1.3 Evaluation and Comparison of Existing Effort Estimation Methods Literature on software effort estimation methods is rich with studies that evaluate and compare several estimation methods [12, 46, 48, 68]. However, they do not provide a clear answer to the question ‘Which method is the best one?’ The first impression one may get when looking over hundreds of empirical studies published so far, is that the only reasonable criterion to evaluate an estimation method is the accuracy of the estimates it derives. The second impression is that this criterion is probably not very helpful in selecting the best estimation method because instead of at least converging results, the reader often has to face inconsistent and sometimes even contradicting outcomes of empirical investigations [46]. The source of this apparent inconsistency is a number of factors that influence the performance of estimation methods, but which are usually not explicitly considered in the published results. Examples are: inconsistent empirical data (source, quality, preprocessing steps applied, etc.), inconsistent configuration of apparently the same method, or inconsistent design of the empirical study (e.g., evaluation strategy and measures). Despite a plethora of published comparative studies, software practitioners have actually still hardly any basis to decide which method they should select for their specific needs and capabilities. In this chapter, we propose an evaluation framework derived directly from industrial objectives and requirements with respect to effort estimation methods.3 In addition, the definitions of individual criteria are based on related works [1, 9, 10, 12, 16, 51]. 3 A series of industrial surveys were performed as part of the research presented in this section. The presentation of the detailed results is, however, beyond the scope of this chapter and will be published in a separate article.


137

We propose to evaluate individual criteria using the four-grade Likert scale [92]. For that purpose, we define each criterion in the form of a sentence that describes its required value from the perspective of industrial objectives and capabilities. We grouped the evaluation criteria in the two groups: criteria related to the estimation method (C01–C10) and criteria related to the estimation outputs (C11–C13). C01. Expert Involvement: The method does not require extensive expert’s involvement, that is, it requires a minimal amount of experts, limited involvement (effort) per expert, minimal expertise. C02. Required data: The method does not require many measurement data of a specific type (i.e., measurement scale) and distribution (e.g., normal). C03. Robustness: The method is robust to low-quality inputs, that is, incomplete (e.g., missing data), inconsistent (e.g., data outliers), redundant, and collinear data. C04. Flexibility: The method is free from a specific estimation model and provides context-specific outputs. C05. Complexity: The method has limited complexity, that is, it does not employ many techniques, its underlying theory is easy to understand, and it does not require specifying many sophisticated parameters. C06. Support level: There is comprehensive support provided along with the method, that is, complete and understandable documentation as well as a useful software tool. C07. Handling uncertainty: The method supports handling the uncertainty of the estimation (i.e., inputs and outputs). C08. Comprehensiveness: The method can be applied to estimate different kinds of project activities (e.g., management and engineering) on various levels of granularity (e.g., project, phase, and task). C09. Availability: The method can be applied during all stages (phases) of the software development lifecycle. C10. Empirical evidence: There is comprehensive empirical evidence supporting theoretical and practical validity of the method. C11. Informative power: The method provides complete and understandable information that supports the achievement of numerous estimation objectives (e.g., effective effort management). In particular, it provides context-specific information regarding relevant effort factors, their interactions, and their impact on effort. C12. Reliability: The method provides the output that reflects the true situation in a given context. In particular, it provides accurate, precise and repeatable estimation outputs. C13. Portability: The method provides estimation outputs that are either applicable in other contexts without any modification or are easily adaptable to other contexts.

¨ S ET AL. M. KLA

138

We evaluate existing estimation methods on each criterion by rating our agreement regarding the extent to which each method fulfills a given requirement. We use the following symbols: (++) strongly agree, (+) agree, () disagree, and () strongly disagree. Presented in the Table I, evaluation is based on individual author’s experiences and critique presented in related literature. It includes both subjective and objective results. An evaluation of existing estimation methods against industry-oriented criteria shows that none of them fully responds to industrial needs. One of the few methods that support most of the estimation objectives is the CoBRA method. Yet, it has still several significant weaknesses that may prevent its wide industrial acceptance. First is the substantial involvement of human experts. The CoBRA causal effort model (the socalled CO model) is currently built exclusively by experts, which significantly increases estimation costs and reduces the reliability of outputs. The second problem is the unclear impact of the selected simulation technique on the reliability and computational cost of estimation outputs. In this chapter, we investigate the second problem.

3.2

Overview of Random Sampling Techniques

In Section 2.2, we provided the necessary theoretical foundations of simulation techniques such as LH and MC, including literature references. Therefore, we reduce the scope of our review in this section to literature regarding comparative studies of sampling techniques (concerning their theoretical and practical efficiency/ usability issues) that can be applied in the context of cost estimation with CoBRAÒ . We consider only methods that can be used for high problem dimensions (number of input distributions). We do not consider approaches for ‘very high-dimensional’ problems like Latin Supercube Sampling [72], since they are of limited practical applicability in the context of software cost estimation. Saliby describes and compares in [80a] a sampling method called Descriptive Sampling (DS) against LH and shows that DS is an improvement over LH. He proves that DS represents the upper limit of maximal improvement over standard MC that could be achieved with LH. Yet, he also showed that the improvement of DS over LH sampling decreases with an increasing number of iterations. The experimental data provided in the chapter shows that the improvement at even relatively small numbers of iterations, such as 1,000 (in our study we used between 10,000 and 640,000 iterations) is not significant anymore ( > > D1;v with probability m > > > > > > 1 > n < D2;v with probability X m ð9Þ D¼ Dv with Dv ¼ ... > > v¼1 > > > > > 1 > > > : Dm;v with probability m However, we are interested in the expected value (mean) E of distribution D. Assuming the linearity of the expected value and a lack of correlation between D1, . . ., Dn, we can derive the following equation: Eð D Þ ¼

m X n 1X E De;v m e¼1 v¼1

ð10Þ

After considering that De,v’s represent the expert estimations as triangular distributions in the form Triang (ae,v, be.v, ce,v), where a, b, and c are the known minimum, most likely, and maximum cost overhead, we obtain: EðDÞ ¼

m X n 1X ae;v þ be;v þ ce;v m e¼1 v¼1 3

ð11Þ

The derivation of an algorithm that implements Equation 11 is trivial. It delivers no error, because the results are calculated analytically. The asymptotical runtime of the analytical mean computation is O(m n), the respective memory usage is O(1). In practice, computation on a 1212 test matrix consists of 432 additions, which results in non-noticeable runtime of less than 1 ms on our test machine (desktop pc).

5.2

Distribution Computation

For AS2 and AS3, the density distribution D of the expert estimation matrix D(m,n) is needed. In order to analytically determine a function D(x) that describes the density distribution, again, we can use the mathematical representation introduced


145

in Equation 9. The need density function of Dv(x) can be computed using Equation 12, where De,v(x) is the density function of the single triangular distribution. m 1X Dv ð x Þ ¼ De;v ðxÞ ð12Þ m e¼1 But the next step would be the calculation of a sum of nontrivial probability functions (see Equation 9). The only analytical possibility to build a sum of nontrivial probability functions is to calculate their convolution [25]. In case of probability density function D, this means to solve an (n–1)-multiple integral equation (Equation 13). ð y1 ðx D2 ðy1 y2 Þ . . . dy1 . . . dyn1 ð13Þ DðxÞ ¼ D1 ðx y1 Þ 0

0

This, however, is not a trivial task, especially for larger n. In principle, the integral equation for given Dv’s and x might be computed using the Fast Fourier Transformation [31] or multidimensional Gaussian quadratures [97]. Yet, both approaches deliver only approximations instead of analytically proper (exact) results. So, we cannot present an exact analytical approach to determining the probability density function for expert estimation matrix D(m,n). Therefore, the next logical step is to take a look at MC simulation and other competitive stochastic approaches.

6.

Stochastic Approaches

This section shows the adoption of two stochastic simulation approaches to the approximation of the CO distribution as required in AS2 and AS3. The reason for choosing the first, standard MC sampling is that it has been the approach applied in CoBRAÒ until now. In addition, it is the simplest simulation approach known and serves as a baseline for comparison with more sophisticated simulation approaches. The second approach, LH sampling, was chosen as best competitor based on the results of the literature research (see Section 3). We implemented LH in two variants with differences in runtime and required memory. In the final subsection, we explain why an experimental approach is needed to answer RQ2 and RQ3.

6.1

The MC Approach

For AS2 and AS3, the density distribution D of the expert estimation matrix D(m,n) is needed. In order to obtain an approximation of D with the help of the standard MC, the algorithm follows the attempted sampling described in Section 2.2.1.

¨ S ET AL. M. KLA

146

for i=0 to #Intervals : d[i] = 0; for i=1 to z { sample = 0; for v=1 to n { sample += D-1[random({1,…,m})][v](random([0,1]) } s = roundDown(sample); d[s] = d[s]+1; } for i=0 to #Intervals : d[i] = d[i] / z; return d; FIG. 10. MC sampling in pseudo-code.

In the algorithm, we use the unbiased estimator as defined in Equation 14 to create samples of D (Equation 9). n X m X ð1Þ 1 we xðmÞ ðoÞ D ð14Þ DðoÞ ¼ e;v xv ðoÞ v¼1 e¼1

xðv1Þ ðoÞ is

an independent realization of the probability variable xðv1Þ that is uniformly distributed on [0,1), x(m)(o) is a realization of x(m) that is uniformly distributed over 1 the set {1,. . ., m}, we is the characteristic function of e (Equation 15), and D e;v is the inverse distribution function of the triangular distribution De,v.

1 if x ¼ e we ð x Þ ¼ ð15Þ 0 else

The asymptotical runtime for the MC sampling is O(z n) for a D(m,n) matrix and z iterations4 and the respective memory usage for the computation is O(#intervals) (Fig. 10).

6.2

The LH Approach

In order to obtain the density distribution D of the expert estimation matrix D(m,n) with the help of LH, we make use of sampling as described in Section 2.2.2. For the purpose of calculating D (see Equation 9) with the LH approach, we first need an 4

Under the assumption always valid in practice that m as well as the number of intervals is less than z.


147

unbiased estimator D(o) of D. The starting point for the development of such an estimator is the realization of D(o) presented for MC (Equation 14). If we expect that the number of iterations (z), according to the number of strata is a multiplication of the number of experts (m), then we can optimize Equation 14 by replacing the random variable x(m) and the chi function by 1/m (Equation 16). This is possible because, when stratified by z, x(m) delivers (remember z is a multiplication of m) a sequence of exact values: (z/m 1), (z/m 2), . . ., (z/m m). n X m X 1 1 ð1Þ DðoÞ ¼ De;v xv ðoÞ ð16Þ m v¼1 e¼1

The stratification of the remaining random variable De,v, which is required for implementing an LH algorithm (see Section 2.2.2), is quite simple because we can construct a random number generator with the help of the inversion method for De,v (triangular distribution) [101]. This means that the only random variables that must be stratified are the xðv1Þ (v=1. . .n), which are uniformly distributed on the range [0,1]. In practice, this is done by replacing xðv1Þ by a random variable uniformly distributed between [(pv(i)–1)/z and pv(i)/z]: cv ðo; iÞ ¼

xðv1Þ ðoÞ þ pðiÞ 1 z

ð17Þ

where i is the current iteration, z the total number of iterations, and pv represents random permutation over the elements 1, . . ., z. This way, we get the following estimator (Equation 18), which can be further optimized by removing 1/m, the sum over m, and replacing e with (i mod m) þ 1 (see Equation 19). xð o Þ ¼

xðoÞ ¼

z X n X m 1X 1 1 xðv1Þ ðoÞ þ pðiÞ 1 D z i¼1 v¼1 e¼1 m e;v z

ð18Þ

z X n 1X xðv1Þ ðoÞ þ pðiÞ 1 Dð1 imodmÞþ1;v z i¼1 v¼1 z

ð19Þ

The problem with implementing an estimator defined in such a way is that we need n independent permutations p[v], where each p[v][i] has the probability of 1/z of being equal to c2{1, . . ., z} (*). We have implemented two algorithms that solve this problem in different ways. The first one, LH [Fig. 11(A)], randomly chooses c from the figures 1, . . ., z for each variable v in each iteration i. If the figure is flagged as having been chosen in an earlier iteration, a new figure is chosen; else the figure is used and flagged.

¨ S ET AL. M. KLA

148 A

B

for i=0 to #Intervals : d[i] = 0; p[*][*] = 0; for i=1 to z { sample = 0; for v=1 to n { c = random(0,…,z); while p[v][c] == 1 do p[v][c mod z +1]; p[v][c] == 1; sample += D-1[i mod m][v]( (random ([0,…,1])+c-1)/z) } s = roundDown(sample); d[s] = d[s]+1; } for i=0 to #Intervals : d[i] = d[i] / z; return d

for i=0 to #Intervals : d[i] = 0; for v=1 to n { for i=1 to z { p[v][i] = i; } for i=1 to z { c = random(1,…,z); d = p[v][i]; p[v][i] = p[v][c]; p[v][c] = d; } } for i=1 to z { sample = 0; for v=1 to n { sample += D-1[i mod m][v]( (random ([0,1])+p[v][i]-1)/z ) } s = roundDown(sample); d[s] = d[s]+1; } for i=0 to #Intervals : d[i] = d[i] / z; return d

FIG. 11. Sampling in pseudo-code: (A) LH, (B) LHRO.

For a D(m,n) matrix and z iterations,5 the asymptotical runtime of the LH sampling algorithm is O(z2 n), and memory usage for the computation is O(z n). The second algorithm, LHRO [Fig. 11(B)], represents a runtime-optimized (RO) version. It creates all needed permutations p[v] before the sampling part of the algorithm starts and any iteration is executed. To do this, it permutes for each variable v all numbers from 1,. . ., z at random and stores the result. The proof that the permutations obtained satisfy (*) is a simple induction over z. Computational complexities of the LHRO for a D(m,n) matrix and z iterations6 are asymptotical runtime of O(z n), and memory usage of O(z n). Please note that although both algorithms store O(z n) values, their actual storage differs in that LH stores z n flags (one bit each) and LHRO stores z n integers (32 bits each).

5 6

On the basis of the assumption always valid in practice that m as well as #intervals are less than z2. On the basis of the assumption always valid in practice that m as well as #intervals are less than z.


6.3

149

Comparison of Stochastic Algorithms

When considering the MC and LH algorithms, we are unable to determine accuracy and efficiency regarding AS2 and AS3 based merely on theoretical considerations; neither can we say which one is more accurate or which one is more efficient in our context. This is because we are not aware of any possibility to show that the errors of the algorithms based on the LH approach are lower for typical expert estimation matrices in CoBRAÒ application. Especially, we do not know, if the LH error is lower, to which extent it is lower compared with the error of MC. Additionally, if considering efficiency, for example, as runtime efficiency, we have to execute the algorithms to measure the runtime. The runtime depends, among other things, on the chosen implementation language and execution environment and cannot be calculated theoretically only based merely on the pseudo-code representations. But most notably, MC and LH are stochastic approaches, since their results suffer from a different degree of error, which not only depends on input data and number of iterations, but also on pure randomness. The same statement is true for the runtime. Therefore, in order to draw reliable conclusions regarding RQ2 and RQ3, we conduct an experiment where we compare the different approaches/algorithms in a typical CoBRAÒ application context.

7. Experimental Study 7.1

Experimental Planning

During experimental planning, we first define the constructs accuracy and efficiency we want to measure and use for comparing the sampling approaches. Next, we describe the independent and dependent variables relevant for our experiment and set up some hypotheses to answer RQ2. Then we present the experimental design we use to check our hypothesis and answer RQ2 and RQ3.

7.1.1 Construct: Accuracy In order to quantify the accuracy and efficiency of the simulation techniques evaluated in the study, appropriate metrics had to be defined first. In this section, we start with the quantification of the accuracy construct. The next section deals with the accuracy-dependent efficiency construct.

150

¨ S ET AL. M. KLA

Following the goal/question/metric paradigm [6], we had to consider the object of the study (i.e., the simulation methods), the purpose (i.e., characterization and comparison), the quality focus (accuracy), the perspective (CoBRAÒ method user), and the context. Whereas most of them are straightforward to define in our setting, we can see that two different contexts exist, which are described by application scenarios AS2 and AS3 (see Section 4). AS1 is not relevant at this point because it is covered by the analytical solution presented in the previous section. But before we derived an accuracy measure for each of the two AS, we had to solve a general problem in our setting: In order to measure the accuracy of the simulation output, we need the expected output to perform some kind of comparison between actual and expected output. However, the computation of an analytic correct output distribution is not possible for a complex distribution within an acceptable period of time (see Section 5.2). So instead, we have to use an approximation with a known maximal error regarding applied measures. In the following, when we speak of reference data, we mean the approximation of expected output based on the approximated expected distribution (called reference distribution). We obtain our reference distribution by generating distributions with MC and LH algorithms and a very large number of iterations in order to get extremely high precision. The distributions obtained in this way were next compared to each other with respect to the same measures that were used in the experiment. The magnitude of obtained errors determined the upper limit of accuracy that can be measured in the experiment. It means that a derivation below the identified limit is practically not possible to observe and thus considered not to be significant. We introduced two major types of error measure to compare the results of the sampling algorithms considered: Derivation over Cost Overhead (DoCO) and Derivation over Percentiles (DoP). The DoCO measure has been designed to calculate the deviation between the sampled distribution and the reference distribution with respect to AS1, where we ask how probable it is to be below a certain cost (overhead) limit X, more formally: P(X CO). The DoCO value represents the derivation (absolute error) of PS(X CO) calculated for the sampled distribution from the expected P(X CO), averaged over all meaningful CO values. DoCO ¼

MaxCO1 X 1 jPS ðX < COÞ PR ðX < COÞj ð20Þ ðMaxCO MinCOÞ CO¼MinCO

where MaxCO ¼ max {maximum CO of DS with probability greater than 0, maximum CO of DR with probability greater than 0}, and MinCO ¼ min {minimum CO of DS with probability greater than 0, minimum CO of DR with probability greater than 0}. PS(X < CO) returns the accumulated probability of the sampled


151

Probability distribution Sampled Reference

CO aMin

aMax

FIG. 12. Probabilities of cost overhead values of sampled and reference distribution.

distribution for all CO values less than CO, and PR(X < CO) returns the accumulated probability for the reference distribution for all CO values less than CO. This measure is meant to give more importance to errors spread over a wider range of the distribution than to errors that have ‘local’ impact on a narrow range of the distribution. This property of DoCO is important because narrow local errors appear less frequently when determining the probability for a given CO interval. Consider, for example, the last two intervals in Fig. 12. The deviations between sampled and reference distributions (error) in each of the two intervals have the same magnitude but opposite signs, so that they compensate each other (total error over both intervals is equal to zero). Therefore, considering any larger interval that contains both or none of them would not be affected by derivations (errors) measured separately for each interval. Furthermore, DoCO has the advantage of being independent of errors caused by the data model because it uses the same interval boundaries as the data model, whole numbers of CO unit (short, %CO). The DoP measures were derived from the practice described in AS3: For instance, we might want to estimate the software cost (or cost overhead) that has a certain probability of not being exceeded. More formally, we search for the CO value with a certain probability P(X CO) = p/100 associated to it, where p 2 N, p 2 [1,99]. With DoP we capture the average absolute error over all percentiles7 (Equation 21)

7 The Percentile of a distribution of values is a number xp such that a percentage p of the population values is less than or equal to xp . For example, the 25th percentile of a variable is a value (xp) such that 25% ( p) of the values of the variable fall below that value.

¨ S ET AL. M. KLA

152

Probability

Distribution B

Probability

Distribution A

α−1

α

α−1

α

FIG. 13. Example of two distributions with the same sampling data, but different mean (DR).

as well as the maximum absolute error that is reached in a single percentile (Equation 22): 99 1 X DoPabs ¼ ð21Þ jCOS ð pÞ COR ð pÞj 99 p¼1 DoPmax ¼ max

99

\ jCOS ðpÞ COR ðpÞj

p¼1

ð22Þ

where COS( p) is the CO value (COS) with PS(X COS) = p/100 and COR(p) is the CO value (COR) with PR(X COR) = p/100, where PS(X COS) is the accumulated probability of the sampled distribution for all CO values less than or equal to COS, and PR(X COR) is the accumulated probability of the reference distribution for all CO values less than or equal to COR. The disadvantage of DoP is that the data model we used to store the sampling data8 can theoretically cause an error of 0.5% in CO (absolute error of 0.5). To explain this, let us consider two hypothetical distributions (Fig. 13): l l

(A) PA(a 1% CO) = 1 (a 2 N) and PA(x) = 0 for x 6¼ (a1% CO), (B) PB(a 0% CO) = 1 and PB(x) = 0 for x 6¼ (a 0% CO).

In our data model, both distributions have the same representation: P([0, 1% CO])= 0, . . ., P([a 1% CO, a % CO)) = 1, P([a %CO, a + 1% CO)) = 0, . . .. 8 To store the results of the cost overhead distribution sampling, we used a data model in which every distribution interval is represented by a numeric value. Each value represents the probability that a cost overhead value contained in the respective interval occurs. Each of the half-opened intervals covers the same range: one unit of cost overhead (1% CO). Intervals with a probability value of zero are redundant and need not be stored in the model.


153

Using the data from the data model, we would calculate for both distributions COA(1) = COB(1) = . . . = COA(99) = COB(99), whereas in fact, distribution A should have COA(1) = . . . = COA(99) = a 1% CO and B COB(1) = . . . = COB(99) ¼ a %CO. Therefore, in the worst case, the minimal error of the DoP measures that can be reached is 0.5 of the CO unit (i.e., 0.5% CO). With the understanding of derivation (error) being the opposite of accuracy, we define accuracy of the output as the inverse of the measured derivation regarding AS2: Accuracy=(DoCO)–1. We used DoCO and not DoP to calculate accuracy because DoCO is, contrary to the DoP measures, independent of the imprecision of the sampling data model and therefore allows higher accuracy concerning the calculated derivation.

7.1.2 Construct: Efficiency From the perspective of the CoBRAÒ method user, who wants to perform cost estimation or cost risk analysis, the accuracy of the result and the computation effort needed are the key factors that define efficiency. Therefore, following the goal/ question/metric paradigm, efficiency is considered as accuracy per computation effort. On the one hand, we can define computation effort as a measure of computational expense, measured by the number of executed iterations;9 on the other hand, we can define computation effort as the execution time of the simulation algorithm in a typical execution environment, measured in milliseconds. Here, the number of iterations is independent of the development language and execution environment; measuring the execution time takes into consideration that the runtime of a single iteration can be different in different simulation approaches. Therefore, we defined two efficiency measures: accuracy per iteration (A/I) and accuracy per millisecond (A/ms). A=IðDS Þ ¼

A=msðDS Þ ¼

ðDoCOabs Þ1 # Iterations

ð23Þ

ðDoCOabs Þ1 execution time

ð24Þ

9 The simulation consists of many recalculation cycles, so-called iterations. In each iteration, cost overhead values from triangular distributions across all cost drivers are sampled and used to calculate one possible total cost overhead value (according to the CoBRAÒ causal model).

154

¨ S ET AL. M. KLA

where #Iterations is the number of iterations performed and excecution_time is the runtime of the algorithm in milliseconds.

7.1.3 Independent and Dependent Variables The variables that are controlled in this experiment (independent variables) are the chosen simulation algorithm, the number of iterations executed, the execution environment, as well as the simulation input (i.e., the matrix with the expert estimations). We control these variables, because we expect that they influence the measured direct dependent variables we are interested in: the simulation result (i.e., the sampled CO distribution) and the execution time of the simulation algorithm. On the basis of the sampled distribution, we can calculate the derivation regarding the reference distribution (error) with the DoCO and DoP measures, and with our accuracy definition being based on DoCO. Knowing the accuracy, we can calculate efficiency regarding the number of iterations as well as regarding the required runtime. Therefore, our indirect dependent variables are DoCO, DoP, accuracy, accuracy per iteration (A/I), and accuracy per millisecond (A/ms) (Fig. 14).

7.1.4 Hypotheses On the basis of the previous definition of variables and the RQ stated in Section 4, we have the following hypotheses and corresponding 0-hypotheses (which we want to reject): HA: The LH approach provides more accurate results (regarding DoCO) than the standard MC approach applied with the same number of iterations (10,000). HA0: The LH approach provides less or equally accurate results (regarding DoCO) than the standard MC approach applied with the same number of iterations (10,000). HB: The LH approach is more efficient (per iteration performed) than the standard MC approach when applied with the same number of iterations (10,000). HB0: The LH approach is less efficient than or as efficient as (per performed iteration) the standard MC approach when applied with the same number of iterations (10,000). HC: The LH approach is more efficient (per millisecond of runtime) than the standard MC approach when running in the same execution environment and with the same number of iterations (10,000). HC0: The LH approach is less efficient than or as efficient as (per millisecond of runtime) the standard MC approach when running in the same execution environment and with the same number of iterations (10,000).


155

Independent variables #Iterations

Simulation algorithm

Input: est. matrix

Execution environment

Execution Direct dependent variables Sampled distr.

DoP

Execution time

DoCO

Accuracy (DoCO)−1

Efficiency A/I

Efficiency A/ms Indirect dependent variables

FIG. 14. Relation between (direct/indirect) dependent and independent variables.

There is a hypothesis that would be even more interesting to consider than HC: The LH approach is more efficient (per millisecond of runtime) than the standard MC approach when running in the same execution environment and produces a result of the same accuracy (regarding DoCO). But this hypothesis would be hard to investigate, since receiving enough LH and MC data points with the same result accuracy would be very difficult.

7.1.5 Experimental Design The experimental design is based on the previously stated hypotheses and on the defined dependent and independent variables. In the following, subjects and objects involved in the experiment are presented; then, the chosen experiment design and statistical tests for checking the stated hypotheses are described.

¨ S ET AL. M. KLA

156

Subjects: In our setting, the methods that should be compared to each other are performed by a computer since they are algorithms; consequently, there exist no subjects in the narrow sense. But following the statistical theory used in experimentation, the randomness (o) required in the algorithms, visible as different instantiations of a random variable, and leading to different outcomes, can be seen as a ‘perfect subject.’ Perfect, because it is representative (perfectly random-sampled from the totality), available without any noticeable effort (simply generated by a computer as a set of pseudo-random numbers), and really independent of any other ‘subject.’ Object: In order to get a representative study object for the context of cost estimation (i.e., realistic simulation algorithms input), we decided to use data from a real CoBRAÒ project. For that purpose, we employed data gained during the most recent industrial application of the CoBRAÒ method, which took place in the context of a large Japanese software organization [97]. The input data consisted of measurement data (size, effort) and experts’ assessments (cost drivers, effort multipliers) collected across 16 software projects. The resulting simulation input was a 12 12triangular distribution matrix, where the 144 triangular distributions represent estimates provided by twelve experts for twelve cost drivers. This matrix size is at the upper level when compared to other CoBRAÒ projects known to the authors (Fig. 15). Since the computer can generate without noticeable effort any number of pseudorandom numbers, we have as many ‘subjects’ as we need. Therefore, we decided to conduct a multi-test within object study (i.e., we have multiple subjects, but only one object), where each subject (as a concrete instantiation of used random variables) is used only in one test, which means we have a fully randomized design. The factor

Process or method

Subject

Object

Influencing factors

Simulation algorithm

Instance of random variable (ω)

Expert estimations matrix

Number of iterations, ...

FIG. 15. Mapping of the terms: method, subject, object, and influencing factors for our experiment setting.


157

Table II BLOCK DESIGN: DISTRIBUTION OF TESTS OVER SIMULATION ALGORITHM AND NUMBER OF ITERATIONS Simulation Algorithms Iterations 10 240 000 2 560 000 640 000 160 000 40 000 10 000

MC

LH

LHRO

1, 2, 3 10, 11, 12 19, 20, 21 28, 29, 30 37, 38, 39 46, 47, 48

4, 5, 6 13, 14, 15 22, 23, 24 31, 32, 33 40, 41, 42 49, 50, 51

7, 8, 9 16, 17, 18 25, 26, 27 34, 35, 36 43, 44, 45 52, 53, 54

whose influence should be observed is the chosen simulation algorithm with the three treatments: standard MC, LH, and Latin Hypercube Runtime Optimized (LHRO). Since the number of iterations influenced the measured dependent variables accuracy and execution time, we chose a block design with six blocks with respect to the number of iterations performed: 10k, 40k, 160k, 640k, 2.56M, and 10.24M. Per treatment and block, three tests were performed and the median regarding the used derivation measure was selected. This was done to avoid outliers with respect to measured dependent variables (DoCO and DoP); the median was chosen because it is more robust than the mean (Table II). To confirm our hypothesis, we conducted one-sided Sign Tests between the MC and both LH approaches for each of the presented hypotheses. In addition, we performed one-sided paired t-tests on the normalized10 DoCO values (i.e., inverse accuracy) to provide evidence of the accuracy improvement by LH (HA). The stricter t-test is possible at this point, since we consider simulation errors (which can be assumed to follow a normal distribution).

7.2

Experimental Operation

The experiment was conducted as prescribed in the experiment design. The investigated simulation algorithms were implemented in Java within the existing CoBRAÒ software tool. Tests were performed on a Desktop PC with Windows XP (SP2), AMD AthlonXP3000+, and 1GB DDR-RAM. 10 DoCO values are normalized by multiplying them with the square of iterations performed (i.e., the expected reduction of derivation).

158

¨ S ET AL. M. KLA

For each trail, we let our test system compute the approximated distributions and stored them for further analyses. In addition, the simulation runtime in milliseconds was kept. Problems that occurred during operation were that tests 4–6 could not be performed due to extreme computation time (we stopped after 1 h) and tests 7–9 as well as tests 16–18 were not performable due to stack overflows (memory problem). The resulting distributions were used to calculate the corresponding DoCO and DoP values, ending up with the following tuple for each block of our test design (triple of tests): l l l

Median DoCO, corresponding simulation runtime Median DoPabs, corresponding simulation runtime Median DoPmax, corresponding simulation runtime

The first kind of tuple was then used to get the needed accuracy (A) and efficiency values (A/I, A/ms) for each block.

7.3 Experimental Results In this section, we present and discuss the results of our experiment. We check the stated hypotheses and compare the simulation approaches regarding accuracy and efficiency. The algorithms considered are the previously introduced standard MC sampling (MC), LH sampling, and the runtime optimized version of LH sampling (LHRO).

7.3.1 Accuracy of Simulation Algorithms First, we look at the accuracy of the simulation approaches, more precisely at the DoCO as inverse accuracy. In addition, we preset the DoP results. Even if they are not used to calculate and compare the accuracy of the algorithms, they give some hints about the magnitude of the expected error when applying the different approaches (Tables III–V). Discussion: Considering Table III, one can see that both the LH and the LHRO algorithms have comparable accuracy (regarding DoCO) for a given number of iterations. This is not surprising because both are based on the general LH sampling approach and both differ only with respect to the way they were implemented. The LH algorithms outperform the MC algorithm in accuracy in any given number of iterations. The relative accuracy gain with respect to MC varies for LH (mean 0.60) and LHRO (mean 0.63) around 0.6; this means a 60% improvement of accuracy of LH approaches over MC. The number of iterations seems to have no noticeable influence on this.

SIMULATION TECHNIQUES FOR HYBRID COST ESTIMATION Table III COMPARISON OF DERIVATION OVER COST OVERHEAD DoCO Iterations 10 240 000 2 560 000 640 000 160 000 40 000 10 000

MC

LH

LHRO

3.69E05 8.13E05 2.19E04 4.17E04 8.61E04 1.77E03

– 5.50E05 1.36E04 2.66E04 4.97E04 1.11E03

– – 1.75E04 1.81E04 4.92E04 1.42E03

Table IV COMPARISON OF AVERAGE DERIVATION OVER PERCENTILES DoP Average Iterations 10 240 000 2 560 000 640 000 160 000 40 000 10 000

MC

LH

LHRO

2.34E02 3.85E02 2.84E01 1.49E01 6.55E01 6.73E01

– 3.31E02 9.42E02 2.07E01 2.34E01 5.62E01

– – 1.04E01 1.03E01 2.93E01 8.82E01

Table V COMPARISON OF MAXIMUM DERIVATION OVER PERCENTILES DoPmax Iterations 10 240 000 2 560 000 640 000 160 000 40 000 10 000

MC

LH

LHRO

7.09E02 4.03E01 4.90E01 5.21E01 1.22E+00 4.09E+00

– 2.15E01 7.09E01 6.28E01 1.95E+00 2.36E+00

– – 8.56E01 5.19E01 2.28E+00 4.28E+00

159

¨ S ET AL. M. KLA

160

Hypothesis testing: We check our hypothesis HA with a sign test and can reject the null hypothesis at an a level of .05 for LH; performing a paired Student’s t-test on normalized DoCO values, we can reject the null hypothesis for both implementations, LH and LHRO. Therefore, we can conclude that the LH approach delivers better results than the standard MC approach in the context of our application scenario and the range of 10 000 to 2 560 000 iterations (Table VI).

7.3.2 Efficiency of Simulation Algorithms After we considered the accuracy of the different algorithms, we next looked at their efficiency. Efficiency is measured as accuracy per iteration as well as accuracy per millisecond of runtime (Table VII). In the following, we discuss the results obtained and check our efficiency-related hypotheses. Discussion: The efficiency index accuracy per iteration shows that the LH algorithms outperform the MC algorithm. The relative accuracy per iteration gain shows the same picture as the accuracy improvement calculated for LH (mean 0.60) and LHRO (mean 0.63). This means around 60% improved A/I of the LH approaches over MC. An interesting aspect, which we can observe in Table VII, is that I/A decreases at the factor 2 when the number of iterations is quadrupled by any of the three sampling approaches. Thus, it can be concluded that the DoCO error Table VI TEST RESULTS REGARDING HYPOTHESIS HA Hypothesis HA Sign test Paired Student’s t-test

LH

LHRO

p = 0.031 p < 0.001

p = 0.063 p = 0.027

Table VII COMPARISON ACCURACY: PER ITERATION (A/I) AND PER MILLISECOND (A/MS) A/I Iterations 10 240 000 2 560 000 640 000 160 000 40 000 10 000

A/ms

MC

LH

LHRO

MC

LH

LHRO

2.65E03 4.80E03 7.14E03 1.50E02 2.90E02 5.66E02

– 7.10E03 1.15E02 2.35E02 5.03E02 9.02E02

– – 8.94E03 3.45E02 5.08E02 7.03E02

5.50E01 9.99E01 1.46E+00 3.12E+00 6.21E+00 1.21E+01

– 3.48E02 1.06E01 3.86E01 1.03E+00 4.44E+00

– – 1.07E+00 4.17E+00 4.20E+00 1.50E+01


161

decreases for all algorithms at the rate of (#iterations–1/2), confirming our expectation based on our theoretical results (Equation 35). The picture changes when looking at Table VII, which presents the accuracy per millisecond results (A/ms). The accuracy-per-iteration advantage of the LH approaches is leveled down by the additional effort for creating the needed random and independent permutations. The precision per millisecond values of the MC and the LHRO algorithms at a given number of iterations are comparable, so that the performance of both algorithms for a given number of iterations can be considered as being nearly equivalent. Both LHRO and MC outperform the LH algorithm that uses (in contrast to the LHRO) a runtime-consuming (yet memory-saving) method to create the permutations. The higher the number of iterations, the higher the gap between the A/ms value of the LH algorithm and the other algorithms. For 10 000 iterations, the A/ms efficiency of the LH algorithm is 2.7 times worse; for 2,560,000 iterations, the efficiency is worse by the factor 28. Our conclusion that the A/ms performance of the MC and LHRO algorithm is nearly equivalent is true only if comparing them with regard to the same number of iterations. Nevertheless, for the same number of iterations, the LHRO algorithm delivers a higher accuracy than the MC algorithm. For example, the accuracy of the LHRO algorithm with 160,000 iterations is nearly equal to the accuracy of the MC algorithm with 640,000 iterations, but when comparing the corresponding A/ms values, the efficiency of the LHRO algorithm is almost twice as good. The problem is that a statistical test to prove this conclusion cannot be provided because we would need comparison data with equal accuracy for all algorithms and such data are difficult to obtain. In order to perform a nondiscriminatory comparison between the performance of the MC and LHRO approach with respect to runtime in ms (A/ms), they have to be compared on the same level of accuracy. Because we do not have the data for MC and LHRO on the same accuracy level, the relation between the number of iterations and the achieved accuracy is considered (Fig. 16). For MC, there seems to be a linear relationship between the square root of the number of iterations and the achieved accuracy. A linear regression through the origin results in the following equation with an r2 value of more than 0.999: pffiffi AMC ¼ 5:7658 z ð25Þ Using Equation 22, the number of iterations (z) that MC requires to reach the accuracy of the LHRO executions at 640,000, 160,000, 40,000, and 10,000 iterations can be calculated. The results are 982, 189, 918, 150, 124, 263, and 14,917 iterations. Additionally, a linear relationship between the number of iterations and the runtime of the implemented algorithm can be recognized for the implemented MC algorithm (r2 > 0.999). Therefore, the runtime of MC can be calculated for 982, 189, 918, 150, 124, 263, and 14,917 iterations (i.e., for the number of iterations MC requires to

¨ S ET AL. M. KLA

162

Accuracy (A)

Relationship between accuracy and number of iterations 6000

LHPO

5000

MC

4000 3000 2000 1000 0 0

100

200

300

400

500

600

700

800

900

SQRT(#interations) FIG. 16. Relationship between accuracy and number of iterations. Table VIII TEST RESULTS REGARDING HYPOTHESES HB AND HC Hypothesis HB Sign test

LH p = 0.031

LHRO p = 0.063

Hypothesis HC Sign test

LH p = 0.969

LHRO p = 0.500

reach the same accuracy as LHPO at 640,000, 160,000, 40,000, and 10,000 iterations). Comparing these runtimes with corresponding runtimes of LHRO shows an average reduction of runtime through LHPO of 30%, equivalent to the efficiency (A/ms) improvement of 77% (mean). Hypothesis testing: We checked our hypotheses HB and HC with a sign test at an a level of 0.05, but we could only reject HB0 for LH. Therefore, based on the limited number of data points, we can only conclude that the LH approach is more efficient regarding the number of iterations (A/I) (Table VIII).

7.4

Validity Discussion

First, we discuss typical threats to validity that are relevant for our experiment. Next, we present upper bound estimation for average simulation error with respect to application scenario AS2 (DoCO) and the dependent accuracy measure.


163

7.4.1 Threats to Validity In this section, we consider possible threats to validity based on the experiment design and its operation. We present them in the categories proposed by Wohlin et al. [105]: First, conclusion validity, which concerns the problem of drawing a wrong conclusion from the experiment outcome; then we look at internal validity, which is threatened by uncontrolled influences distorting the results. Next, construct validity is addressed (‘Do we measure what we propose to measure?’), and finally, external validity is regarded, which describes how well results can be generalized beyond our experimental setting. Conclusion validity: l

l

The sign test, which is primarily used in our experiment, is one of the most robust tests. It makes no assumption beyond those stated in H0. The paired Student’s t-test is only used when comparing normalized simulation errors that can be assumed to be normally distributed. One problem is the low statistical power of the sign tests that results from the low number of pairs that could be compared. When testing LHRO against MC, for example, we could compare only four instead of the expected six pairs, since we were not able to execute tests 7, 8, 9, 16, 17, and 18, which result in stack overflows due to their memory requirements.

Internal validity: l

l

l

l

The chosen implementation in Java and the execution environment influence the runtime of the algorithms. Therefore, other implementations executed in different environments can result in different runtime and thus efficiency. To keep the results of different algorithms and iteration numbers comparable, all algorithms are implemented in the same programming language and executed on the same system. But we cannot assure that each algorithm is implemented in the most runtime-efficient way possible. The measures derived for AS3 (DoP) suffer from measurement inaccuracy as a result of the data model. Therefore, the algorithms are compared based on the measure derived for AS2 (DoCO), which is independent of this bias. The used stochastic simulation algorithms have no deterministic result. Therefore, there is a minor but not dismissible possibility of getting a very unusual result if executing a simulation. In order to avoid the presence of such outliers in analyzed data, we execute three trails (i.e., tests) for each setting and take the median. The reference distribution applied to measure the accuracy of the simulation results is not the analytically correct output distribution. Instead, we have to use an approximation with a known error regarding applied measures. The reason is

¨ S ET AL. M. KLA

164

that computation of an analytically correct output distribution is not possible for a complex distribution within an acceptable period of time. For a more detailed discussion, see Section 7.1. Construct validity: l

The chosen constructs that represent accuracy and efficiency are selected carefully and based on the understanding of accuracy and efficiency in typical AS of cost estimation and cost risk analysis. But we provide no empirical evidence that this is true for the majority of users.

External validity: l

The number of experts and variables as well as the characteristics of input distributions can influence the accuracy and performance of the algorithm. These input data (represented by the distribution matrix) are different in different CoBRAÒ AS. We performed the experiment only for one set of input data; therefore, generalizability of results (i.e., representativity of input data) is an issue. To reduce this threat as much as possible, input data was taken from an actual industrial application. The input data have a complexity in the number of experts and variables at an upper, but not untypical, level compared with other known applications.

7.4.2 Analytical Considerations As previously mentioned, based on theoretical considerations, we cannot decide whether LH is more accurate and efficient than MC in our context. But we can give a lower boundary for the expected accuracy (regarding DoCO) that is true for both MC and LH. Such a lower boundary for accuracy allows us, on the one hand, to perform a simple validity check on the measured accuracy values; on the other hand, it can increase the external validity of our experiment results. To derive this lower boundary, we first consider the MC algorithm. When we look at a single individual interval Is, it appears that for this interval, the algorithm does nothing else than estimate the result of the integral of the density function D(x) over this interval (Equation 26) with the standard MC integration [50]. sþ1 ð

Is ¼

DðxÞdx

ð26Þ

s

Since interval size is one (measured in percentage of cost overhead), Is delivers the average density of D on the interval [s,s+1]. This is interesting because the error of


165

the whole distribution can now be expressed with the help of the errors of the Is estimators . Considering our algorithm (Fig. 10), the estimation of Is is calculated as follows: z 1X ; with i ¼ w½s;sþ1 ðDðoi ÞÞ ð27Þ Es ð z Þ ¼ z i¼1 i D(oi) is the i-th independent realization of the random variable D(o) with distribution D and w[s,s+1] is the characteristic function for the interval [s,s+1] (Equation 28).

1 if x 2 ½s; s þ 1 w½s;sþ1 ðxÞ ¼ ð28Þ 0 else This estimator is unbiased, meaning limz!1 Es(z) = Is. This is clear when we recall that the expected value is the ratio of |DS| to |D|, and that |D| = 1 (D is a probability density distribution). Now, in order to calculate the expected error for z iterations with Equation 4, we need the standard deviation (or variance) of our estimator. Having the variance definition (Equation 29) and E() = E(2) = Is, we derive upper bounds for estimator variance (Equation 30). V ð Þ ¼ E 2 Eð Þ 2 ð29Þ V ðÞ ¼ Is Is2 Is 1

ð30Þ

The expected error for z iterations can be calculated with Equation 4 as follows (Equation 31): pffiffiffiffi Is EARIs pffiffi ð31Þ z Example: If we have an average value of 0.01 over the interval [s,s+1] and run 10 000 iterations, we would get an EARIs of 0.1/100 = 0.001 (corresponding to a relative error of 10%). In addition, Equation 31 can be used to provide a theoretical upper boundary estimation of Deviation over Cost Overhead (DoCO) measure (Equation 20). The term jPs ðX < iÞPR ðX < iÞj in the DoCO measure represents nothing else than the absolute derivation of the integral of distribution D over the interval [0,i] (Ii). Expressing Ii with the intervals over [s,s+1] (Equation 32) and reusing Equation 31 allows us to obtain a final estimation of the expected error estimating Ii and DoCO value (Equation 33 and Equation 34, respectively), when executing z iterations. Ii ¼

sþ1 i1 ð X s¼0

s

DðxÞdx ¼

i1 X s¼0

Is

ð32Þ

166

¨ S ET AL. M. KLA

qffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi Pi 1 s ¼0 I s pffiffi EARIi z 1 DoCO pffiffi z #Intervals

ð33Þ vffiffiffiffiffiffiffiffiffiffiffi u t I

#Intervals i1 X uX

s

i ¼1

ð34Þ

s ¼0

At a given number of iterations and intervals, DoCO becomes maximal if the double sum in Equation 34 becomes maximal. This, in turn, happens when I1 is 1 and all other Is are equal to 0 (consider that the sum of all Is = |D| = 1). pffiffi 1 DoCO pffiffi and Accuracy z z

ð35Þ

Equation 35 is a weak assessment, but it is sufficient for our purpose. A stronger assessment (dependent on #Intervals) is possible regarding the exact variance of Is. Example: If we sample a distribution D with MC and 10,000 iterations, we get an expected DoCO value of less than 0.01. The expected error of the LH approach can be estimated with the same equations as those used by the standard MC approach. In particular, Equation 35 holds for the expected DoCO value. The reason is that the LH approach is a special case of the standard MC approach and converges at least as fast as the MC approach (see Section 2.2.2).

8. Summary In this chapter, we investigated the potential impact of simulation techniques on the estimation error of CoBRAÒ , as an exemplary cost estimation and cost risk analyzing method. This was done by deriving an analytical solution for point estimations and performing an experiment with industrial project data [97]. This experiment was necessary to compare the stochastic simulation approaches when applied to the sophisticated analysis of project costs. We could answer the question of whether there exist techniques that deliver more accurate results than simple MC sampling or performing the simulation in a more efficient way. In addition, we present results regarding the magnitude of accuracy and efficiency improvement that can be reached through the use of LH as an alternative sampling technique. The summarizing presentation of results is structured according to the three detailed RQ defined in Section 4 and the context of the three different AS; see Table IX.


167

Table IX ANSWERED RESEARCH QUESTIONS

Application Scenario

RQ1 Analytical Feasibility

AS1 AS2

Yes No

AS3

No

RQ2 Comparison: Accuracy and Efficiency

RQ3 Magnitude of Improvement

Not relevant HA0 rejected (accuracy A) HB0 rejected (efficiency A/I) HC0 not rejected (efficiency A/ms) –

Not relevant 60% accuracy (A) and 77% efficiency (A/ms) gain by LHPO –

With respect to RQ1, we showed in Section 5 that analytical mean computation (AS1) is possible and should be preferred over computation based on simulation. First of all, in contrast to stochastic approaches, the analytical approach provided repeatable and error-free results. Besides that, it has an extremely short runtime (

Software Development

Open Sourse Software Development

Aspect-Oriented Software Development

Quality Software Development

Agile Software Development Ecosystems

Model-Driven Software Development

Open Source, Software Development

Model-Driven Software Development

Global software development handbook

Software engineering and development

Agile Software Development: Best Practices for Large Software Development Projects

Elementary Logic: For Software Development

Agile Software Development Quality Assurance

Agile Software Development Quality Assurance

Mathematical Foundations of Software Development

Successful Software Development (2nd Edition)